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Abstract. A function has a dependent type when the type of its result depends upon 
the value of its argument. The type of all types is the type of every type, including 
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1. Introduction 

1.1. Dependent function types 

A function has a dependent type when the type of its result depends upon the 
value of its argument. A simple example of a function with a dependent type is 
the unary function zero-vector that, when applied to an integer n, returns an n- 
vector of zeroes. If all vectors are given the same type vector, then zero-vector 
can be given the simple functional type 

int — > vector . 

On the other hand, we may choose to make vector types more informative by having 
the type of a vector reflect its length. In this case, vector is not a type constant 
but a parameterized type: (vector n) denotes the type of vectors of length n. We 
can thus describe the type of the value (zero-vector n), for a given n, as (vectors); 
in symbols, 

(zero- vector n) : (vector n) , 

where ':' is read as 'has type.' But now zero-vector no longer has the simple 
type given above, for the type of (zero-vector n) depends on n; i.e., the type of 
(zero-vector n) is a function of n. This suggests that we use the type-returning 
function 

Anrint. (vector n) , 

often called a type generator or a type constructor, as the type of zero-vector, 
for it accurately describes the type of the value of zero-vector at the argument n. 
However, to maintain the distinction between functions and types, we use II in 
place of A as an abstraction symbol for type expressions. We therefore have 

zero-vector : IIn:int. (vector n) . 

The dependent function type Hx:A.B, also called a general product type, is the 
type of functions that map an element a of type A to an element of type B[a/x], 
where B[a/x] stands for B with a substituted for all free occurrences of x. Ordinary 
function types are a special case of dependent types, for the type A — > B is simply 
Hx:A.B, where x is chosen to be an identifier not free in J5. 

Terms (i.e., programs), which denote functions and values, and type expres- 
sions, which classify terms, are syntactically and semantically distinct in most ex- 
plicitly typed programming languages. This distinction permits static typecheck- 
ing: A term can be typechecked (e.g., by a compiler) in advance of performing the 
computation that it describes. In type systems that support dependent function 
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types this distinction is blurred, for terms can appear in type expressions and it 
may be necessary to perform some computation in order to typecheck a term. For 
example, consider the function 

neg-vector : IIn:int. (vector n) — ► (vector n) 

which, given an integer n, returns a function that negates each element of a given 
n-vector. When we apply neg-vector to a particular integer, say 23, we obtain a 
function 

(neg-vector 23) : (vector 23) — ► (vector 23) . 

Now suppose that M is a term of type int and that x is a variable of type 
(vector M). In order to typecheck the application 

((neg-vector 23) x) , 

we must verify that x is of type (vector 23), and this requires checking that M 
computes to 23. While typechecking may require computation, it is still possible 
to distinguish between the process of typechecking a term, which may require 
performing the computations described by some other terms, and the process of 
performing the computation described by the term itself. 

1.2. The type of all types 

The type of all types is the type of every type, including itself. In symbols, writ- 
ing '•' for the type of all types, we have A : • for every type A and, since • is its 
own type, * : *. 

By admitting the type of all types, we admit types as true "first-class" citizens, 
allowing types to be treated just like ordinary values. In particular, functions on 
types can be defined by ordinary A-abstraction; e.g., writing c x' for pair (i.e., 
product) types, we can define 

three-tuple = \A:*.A x A x A 

and then write (three-tuple int) for int x int x int, the type of three-tuples of 
integers. Just as functions involving integers have types containing int, so functions 
involving types have types containing •. Thus the three-tuple type generator has 
type * — > *; similarly, the parameterized type vector used above has type int — ► *. 
In the presence of dependent function types, the type of all types allows the 
expression of parametric polymorphism [Strachey 1967, Reynolds 1983], which can 
be found in the programming languages CLU [Liskov et al. 1981], Ada [Ada 1980], 
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Russell [Boehm et al 1980, Donahue k Demers 1985], and ML [Milner 1983]. In- 
tuitively, we can think of a polymorphic function as a function mapping types to 
values; a polymorphic function has a dependent type because the type of its result 
depends upon the value of its argument, which in this case is a type. Polymorphic 
functions are easily expressed in a A-calculus with dependent function types and 
the type of all types because types can be treated as values: Type variables are 
just variables of type •, abstraction with respect to a type variable is done with 
ordinary A-abstraction, and the application of a polymorphic function to a type is 
ordinary function application. For example, let Abea type variable in the function 

\x\A.x . 

By A-abstracting over this function with respect to A, we obtain the polymorphic 
identity function 

id = \A\* .\x\A.x 
: ILA: + .A^A. 

When id is applied to a type, it yields the identity function on that type; e.g., for 
the type int — > int, 

id (int —» int) = Aorrint — > int.x , 

which in this case is a function of type (int — ► int) — > (int — ► int). 

Thus a A-calculus with dependent function types and the type of all types 
subsumes the polymorphic A-calculus of [Girard 1972] and [Reynolds 1974], which 
is itself a very rich and powerful language. Any recursive numeric function that 
is provably total in second-order Peano arithmetic can be represented in this cal- 
culus [Girard 1972, Statman 1981, Fortune et al 1983]; there are no known un- 
contrived examples of total recursive functions that are not in this class. Many 
interesting generic data types can be defined, including pairs, unions, and homo- 
geneous lists and trees [Reynolds 1985, Bohm & Berarducci 1985]. 

Going beyond the polymorphic A-calculus, in a A-calculus with dependent 
function types and the type of all types we can apply the programming techniques 
of the more powerful Calculus of Constructions [Coquand 1985b, Mohring 1986, 
Coquand & Huet 1988], For example, we can define a form of dependent pair 
type, also called a general sum or an existential type, that is useful for modelling 
abstract data types [Mitchell k Plotkin 1985, MacQueen 1986]. 

The combination of dependent function types and the type of all types yields 
enormous expressive power at very little apparent cost, and it does so in a concep- 
tually clean and uniform way by treating types as values. Unfortunately, we shall 
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see that the typechecking problem for a language with these features is undecid- 
able. That is, there is no effective algorithm for computing the type of a program, 
even though the type of every identifier is explicitly declared. 



1.3. The A*-calculus 

This thesis is a study of dependent function types and the type of all types in 
the setting of the A*-calculus, which is intended to be a minimal typed A-calculus 
incorporating these two features. The A*-calculus, defined in §2, can be seen as a 
strongly- and explicitly-typed functional programming language in which functions 
are first-class values. Functions (A-terms) are classified by dependent function 
types (II-terms), which in turn have type *. As we shall see, many of the familiar 
properties of typed A-calculi hold for the A*-calculus: 

(1) Reduction is Church- Rosser, i.e., confluent. 

(2) Reduction is type preserving: If M : A and M — ► TV, then 
N : A, where '— ►' denotes the one-step reduction relation on 
A*-terms. In other words, evaluation does not change the type 
of a term. 

(3) The static typing property holds: The processes of typechecking 
a term and of performing the computation that it describes are 
distinct, i.e., types need not be checked during evaluation. 

However, a number of expected properties fail to hold for the A*-calculus. In §3 
and §4 we shall establish that: 

(4) Strong normalization fails: There exist terms that have no nor- 
mal form (i.e., their evaluation does not terminate). 

(5) The normal-form relation is undecidable: For two terms M and 
N such that N is a normal form, it is undecidable whether 
M -» N ', where '-»' denotes the multi-step reduction relation 
on A*-terms. 

(6) The equational theory is undecidable: For two terms M and iV, 
it is undecidable whether M —^ N \ where *=^' denotes provable 
equality (i.e., program equivalence) under ^-conversion. 

(7) The typing theory is undecidable: For a term M and a type A, 
it is undecidable whether M : A. 
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We normally associate these failed properties with languages in which divergent 
recursive computations can be expressed, so it is surprising that (4)-(7) apply to 
the A*-calculus, which has no primitives for recursion and in which recursion is not 
obviously definable. The positive forms of (4)-(7) are enjoyed by a variety of typed 
A-calculi, including the simply-typed A-calculus [Barendregt 1984, Appendix A], 
the polymorphic A-calculus [Girard 1972, Reynolds 1974], and the Calculus of 
Constructions [Coquand 1985b, Coquand & Huet 1988]. 

That strong normalization fails (4) for languages like the A*-calculus has been 
known for some time; the central result of this thesis is that the normal-form 
relation is undecidable (5). The undecidability of the equational theory (6) follows 
from (5) because, by the Church-Rosser property (1), the equational theory is 
characterized by the reduction rules. The undecidability of the typing theory (7) 
follows from (5) because computation is required, in general, in order to typecheck 
a term. 

1.4. Overview 

Girard's paradox. The A*-calculus is not a recent invention: Martin-Lof's first In- 
tuitionistic Theory of Types [Martin-L6f 1971] is a higher-order constructive logic 
that is essentially equivalent to the A*-calculus. Martin-L6f wanted a single for- 
malism that would be adequate for the formalization of a substantial portion of 
constructive mathematics, and he believed that the A*-calculus, with its type of 
all types, had sufficient expressive power to meet this requirement. Martin-Lof's 
type theory is based upon a connection between intuitionistic logics and typed 
A-calculi known as the propositions- as-ty pes analogy. Under this analogy, logical 
propositions are written as types, and a proof of a proposition is a A-term of the 
appropriate type. 

[Girard 1972] showed Martin-Lof's type theory to be inconsistent by refor- 
mulating the Burali-Forti paradox [Burali-Forti 1897] of classical set theory; this 
reformulation has come to be known as Girard's paradox. The upshot of the para- 
dox is a proof of the absurd proposition, which asserts that every proposition is 
provable. In the A*-calculus, the absurd proposition is written as the type nA:*.A, 
and Girard's argument describes how to construct a proof of this proposition, i.e., 
a closed A*-term of this type. It is straightforward to show that no term of this 
type has a normal form, and this implies the failure of strong normalization. 

Looping combinators. The failure of strong normalization does not, however, imply 
the undecidability of normal forms, equations, or typings in the A*-calculus. In 
order to examine the actual non-normalizing term described by Girard's proof, 
in §3 we follow the paradox to construct a term Z of type nA:*.A, using an 
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improved formulation adapted from [Coquand 1986] and [Howe 1987]. Being too 
complex to be carried out by hand, the construction is done with the assistance of 
a computer program called LP, which is a typechecking and reduction engine for 
general typed A-calculi. Given the typechecking rules for a particular calculus, LP 
provides a Lisp-like interface that accepts an identifier definition, typechecks the 
definition, and enters it into the global environment for use in later definitions. LP 
and its input language, which is essentially a sugared version of the A*-calculus, 
are described in Appendix A. 

Observation of the reduction behavior of Z shows that certain of its subterms, 
which correspond to formal proofs of lemmas used in the paradox proof, continu- 
ously reappear at the front of Z as it is reduced. We show how to build a polymor- 
phic looping combinator Lo by making minor modifications to the paradox con- 
struction; this term, written in the LP input language, is contained in Appendix B. 
A polymorphic looping combinator L t is a term of type UA:*.(A — > A) — + A such 
that, for any type A and function / : A — * A, we have 

(Li A /) - / (L,-+i A f) , 

where Li+i is another looping combinator. Intuitively, a looping combinator is 
"just as good as" a fixed-point combinator for the purpose of expressing recursive 
computations. Recall that the polymorphic fixed-point combinator Y has the 
reduction behavior 

(YAf)^f(YAf). 

The only difference between a fixed-point combinator Y and a looping combina- 
tor L is that an application of Y reduces to a term involving Y itself, while an 
application of L reduces to a term involving another, possibly different, looping 
combinator. 

Undecidability. One way of showing that the normal- form relation of the A*-calculus 
is undecidable is to show that all partial recursive functions can be defined within it. 
As is well known, any partial recursive function can be expressed in terms of 
the initial functions and the function-forming operations of composition, primitive 
recursion, and minimalization. It would therefore suffice to show that we can 
compute, in the A*-calculus, all functions constructed in this manner. The primitive 
recursion and minimalization operators are typically implemented using a fixed- 
point combinator, but true fixed points are not required; all that is necessary is the 
ability to iterate a function an arbitrary number of times. Looping combinators 
have exactly this ability, so the undecidability result would follow immediately by 
reduction from the halting problem. 
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Unfortunately, as we discuss in §4, we don't know quite enough about the 
behavior of the constructed looping combinator Lo to be able to apply this method. 
However, we can show that all total recursive fuoctioEi* eaa be computed in the 
A*~cakulus. A simple complexity-theoretic argument thea proves that the normal- 
form relation of the A*-calculus is undecidable, 6tn follows that the 
equational and typing theories are imdecidable as well, 



2. The A*-calculus 

Terms can appear in type expressions in the A*-calculus, so we cannot first define 
type expressions and then define the set of terms, as is possible for simpler typed 
A-calculi. The syntactic machinery of the A*-calculus is therefore much like that 
of AUTOMATH [Barendregt & Rezus 1983] and the Calculus of Constructions [Co- 
quand 1985b, Coquand & Huet 1988]. We first define the set A* of raw terms and 
a notion of reduction upon them. We then restrict the raw terms to the well-typed 
terms through a proof system for typing statements, which are assertions about 
the type of a term relative to the types of its free variables. Thus the raw terms 
include both the well-typed terms and many other terms that are not well-typed. 

2.1. Raw terms 

Fix a countably infinite set of variables. In what follows, x, y, and z are metavari- 
ables for variables and M and TV are metavariables for terms. Other capital Roman 
letters are occasionally used for terms; in particular, A, 5, and C stand for terms 
intended to be types. The set A* of raw terms is the smallest set defined by the 
following inductive clauses: 

x G A* every variable is a term 

^EA* V is a term 

(M N) G A* application 

(Xx:A.M) G A* A-abstraction 

(Ux:A.B) G A* Il-abstraction 

In a raw abstraction it is possible to have occurrences of the bound variable x free 
in the binding type A; for definiteness we say that such occurrences are not bound 
by the binding symbol of the abstraction, but in fact the typing rules will forbid 
such occurrences. 

We adopt the following variable convention: If a set of terms occurs together, 
for example, in a definition, then all bound variables in these terms are distinct 
from each other and from the free variables [Barendregt 1984, Appendix C]. We also 
identify terms modulo the uniform renaming of bound variables (a-conversion); in 
combination with the variable convention, this allows us to work with representa- 
tives of the a-equivalence classes of terms rather than terms themselves. When 
used between terms, '=' denotes syntactic equality modulo a-conversion. 

The set of free variables of M is denoted fv(M), and the substitution of N for 
all free occurrences of x in M is denoted by M[N/x]\ both are defined inductively 
on the structure of terms in the usual way. 



M 


y 


M' 


N 


-> 


N' 


M 


_* 


M' 



The function type expression A -> B abbreviates (lis: AS), where x does not 
occur free in B. We follow the familiar convention that — > associates to the right, 
so that A -> 5 -> C abbreviates A -> (5 — ► (7). Application associates to the left 
so that (F M N) abbreviates ((F M) N). The vector notation (M N) abbreviates 
(M Ni N 2 -- iVfe); similarly, A£:AM abbreviates Axi:A-Ax2^2- • • ■ Ax^A^.M. 

2.2. Reduction 

The one-step reduction relation —> is inductively defined as the least relation sat- 
isfying the axiom of ^-contraction, 

(As: AM) TV -> M[AT/x] , 
and the inference rules: 

=> M N ^ M 1 N 

=j> M N -^ M N 1 

=> (\x:A.M) -► (Ax:AM'), (ILr:AM) -* (ILr:AM') 

A -► A => (Ax:AM) -► (Az:A.M), (ILr:AM) -► (IIx:A.M) . 

Note that there is no notion of ^-contraction for II-abstractions; this is intentional, 
as II-abstractions are dissected only by the typing rules. A term M is a normal 
form (nf) iff there is no term N such that M — > N. The multi-step reduction 
relation -» is the transitive, reflexive closure of — ►, and the conversion relation «-» 
is the equivalence relation generated by -». If AT is a nf and M «-» AT, we say 
that A r is a normal form of M. As expected, the Church-Rosser property holds for 
reduction: 

Lemma 2.1. If M -» M\ and M -» M2, then there exists an AT such 
that Mi -» AT and M 2 -» AT. 

Proo/. See [Martin-Lof 1971]. ■ 

We have the usual corollaries, proved by the same methods as for the untyped 
A-calculus [Barendregt 1984, §3.1]. 

Corollary 2.2. M\ «-» M2 iff there exists an N such that M\ -» N and 

M 2 ^ N. 

Corollary 2.3. Normal forms of given terms are unique, if they exist. 
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The notion of Lead normal form (hnf) for raw terms, useful in the analysis of 
non-normalizing terms, is adapted from the untyped A-calculus [Barendregt 1984, 
Def. 2.2.11]. A term of A* is a hnf iff it is of one of the following forms: 

\x:A.(+ M) 

\x:A.(yM) 

Xx:A.((Uz:A.B) M) 

Note that x , A, and M may be empty, and y may be free or bound. A term M is 
said to Lave a hnf iff there exists a hnf N such that M «-» N. 

Proposition 2.4. If M = (Mi M 2 ) is a nf, then M is of the form (Z iV), 
where Z is either •, a variable, or a II-abstraction. 

Proof by induction on the structure of terms, analyzing the structure of M\. If 
Mi is *, a variable, or a II-abstraction, then Z = Mi and N = M 2 - Mi cannot be 
a A-abstraction since M is a nf. If Mi is an application, then by induction it is of 
the form (Z N) for some appropriate Z, so M = ((Z N) M 2 ). ■ 

Proposition 2.5. If M is a nf, then M is a hnf. 

Proof by induction on the structure of terms. The cases for *, variables, and II- 
abstractions are obvious. If M is a A-abstraction, then by induction its body must 
be a hnf, making M itself a hnf. If M = (Mi M 2 ) then, by Proposition 2.4, M is 
a hnf. ■ 

2.3. Well-typed terms 

A typing statement consists of a typing and a context. The typing associates a 
term with a type, and is a pair of terms written M : A. The context* records the 
types of the free variables in the typing, and is a sequence of typings of variables 
(e.g., (x:A,y:B,z:C)). The empty context is written {), and the context A with 
the typing x:A appended is written A, x:A. A complete typing statement is written 
A h M : A and can be read, 'under the variable declarations in A, the term M 
has type A.' 

The proof system for typing statements contains one axiom and seven infer- 
ence rules. Each inference rule consists of a set of antecedent statements and a 
consequent statement, graphically separated by a horizontal line. A typing state- 
ment is provable iff it is the axiom, or iff it is the consequent of an inference rule 

*Sometimes called a type assignment or type environment. 



THE A*-CALCULUS H 

whose antecedents are all provable. A term M is said to have type A iff there is 
a context A such that A h M : A is provable, and M is said to be well-typed iff 
there is a type A such that M has type A. The proof system is carefully designed 
so that every provable typing statement A h M : A is well-formed, meaning that 
every free variable in A, M, and A is declared in A, no variable is declared more 
than once, and the type of every declared variable is provably of type *. 

The typing rules can be divided into those that manipulate contexts and 
those that construct types. The context manipulation rules make use of empty 
statements, written A h, to indicate that A alone is well-formed. The context 
manipulation rules are: 



(ci) H 



context 
initialization 



(+ . +\ type of all types 

1 ' } Ah*:* 

AHA:* , context 

( cx ) ~K~lr~A\- X extension 

Ah a a context 

( C P) Ahx : A e projection 

Note that x:A € A means that the typing x:A occurs in A, and x £ A means that 
there is no typing y:A € A such that x - y. The (ci) rule simply says that the 
empty context is well-formed. The (*:*) rule allows the introduction of the type 
of all types. The (cx) rule is used to declare a new variable x of type A after A is 
proved to be a type, and the (cp) rule allows a previously declared variable to be 
projected from the context into a typing. 
The rules for type construction are: 



(in) 

(Hi) 
(He) 
(tc) 



A,x:Ah B : • 




A h (Ux:A.B) : * 




A,x:A\- M :B 




A h (Xx:A.M) : (ILx:A.B) 




A\- M :{Ilx:A.B), A\~N: 


A 


Ah(MiV): B[N/x] 




A\~M:A, Ah£:* . 
■ A «->► B 



II-formation 



Il-introduction 



II-elimination 



type 

A h M ' B -*---— conversion 
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The first three rules construct the type of a term from the types of its subterms, 
and correspond exactly to the term formation operations of II-abstraction, A- 
abstraction, and application. The first two rules also modify the context, dis- 
charging the newly bound variable x. The final rule (tc) allows the type of a term 
to be replaced with a type to which it converts, establishing the connection between 
computation and the process of constructing the type of a term. 

Notice that each group of rules depends upon the other. The antecedent of the 
(ex) rule is a typing statement that can be proved by any of the type construction 
rules, as well as by the (cp) rule. The antecedents of the type construction rules 
are typing statements that can be proved by the (cp) rule, as well as by the other 
type construction rules. In general, the proof of a typing statement requires the 
mixed use of both kinds of rules. 



2.4. Properties of provable typing statements 

The notation A h <p stands for an arbitrary statement; ip is either a typing, in 
the case of a typing statement, or ip is empty, in the case of an empty statement. 
If ip = M : A, then fv(tp) = fv(M) U fv(A); otherwise, fv(c^) = 0. Unless 
otherwise noted, the proofs in this subsection proceed by induction on the definition 
of statement provability. 

Well-formedness. Although contexts are sequences of typings rather than sets of 
typings or functions from variables to terms, the proof system is designed so that 
a context in a provable statement will never contain more than one typing for any 
variable. 

Lemma 2.6. If A h ip is provable then, for every x:A G A, there is no 
other x:B e A for any B. 

Thus we can conveniently think of contexts as partial functions from variables to 
their declared types; i.e., A(x) = A iff x:A € A. 

An important property of the proof system is that in a provable statement 
A h (/?, the type of any free variable in ip or of any declared variable in A is guar- 
anteed to contain only previously declared variables that are themselves declared 
in A. Certain nonsensical situations can arise if this property does not hold; e.g., 
a variable can have a type containing itself or an undeclared variable. Because 
contexts are sequences, they record the history of the declarations that they con- 
tain. Relative to a variable x, the previously declared variables in a context A — i.e., 
those comprising the context in which x was declared — are just those variables that 
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precede a; in A. Let A* denote the proper prefix of A preceding x: A if x: A € A. 
Then we have 

Lemma 2.7. If A h tp is provable, then fv(y>) C domA and, for each 
x e domA, we have that fv(A(x)) C dom A x . 

These two lemmas are equivalent to the "variable restrictions" of [Martin- Lof 1971]. 
Finally, we verify that each term associated with a declared variable x in a 
provable statement is actually a type, i.e., provably of type * in the context in 
which x was declared. 

Lemma 2.8. If A H <p is provable, then A x h A(x) : * is provable for 
each x £ domA. 

The type of all types. The type of all types, *, is the type of every type, including 
itself. In the A*-calculus, a type is any term appearing on the right-hand side of a 
colon in a provable typing statement. Therefore any such term should be provably 
of type * in the same context. 

Lemma 2.9. If A h M : A is provable, then A H A : • is provable. 

Reduction and typing. The following lemmas, or stronger versions of them, are 
proved in [Martin- Lof 1971]; essentially the same proofs work for the A*-calculus. 

Lemma 2.10 (Replacement). If A,x:A h M : B and A h TV : A are 
provable, then A h M[N/x] : B[N/x] is provable. 

Lemma 2.11 (Type Preservation). If A h M : A is provable and M -» 

TV, then A h N : A is provable. 

Type preservation is sometimes called subject reduction, but we prefer to reserve 
that name for its original meaning as a similar property of untyped A-terms [Curry 
& Feys 1958, Hindley & Seldin 1986]. 

Lemma 2.12 (Unique Typing). If A h M : A and A h M : B are 
provable, then A <*-» B. 

Static typing. Let any type convertible to the form IIx:A* be called a *-type. A 
term with a *-type A is either a type, if A — *, or a function returning a type, 
i.e., a type generator. If A h M : A and A is not a *-type, then the erasure of M, 
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written \M\, is defined inductively as follows: 



\x\ = x 



J |M| if A I- N : A and A is a •-type, 

^ ^~\(\M\\N\) otherwise. 

|(A*:AM)| = (!f {Am if ^ isa ^P e ' 
lv n \{\x\M\) otherwise. 

The erasure map removes all type information from a given term, including both 
types and type generators, yielding a term of the untyped A-calculus. (This defini- 
tion is adapted from the definition of stripping given in [Coquand & Huet 1988].) 

Lemma 2.13 (Static Typing). If A h M : A is provable and A is not a 
*-type, then M -* JV iff |Af | -» \N\. 

In other words, the reduction path of a well- typed term coincides with the reduction 
path of its erasure. Therefore it is not necessary to consider any of the type 
information in a term when performing the computation that it describes. 

Non-normalizing terms. It seems to be well known that in the A*-calculus, and 
in other A-calculi with type abstraction, no term of type UA:*.A has a nf; for 
completeness we prove this fact here. It suffices to show that no term of type 
UA:*.A is a nf, from which it follows by Lemma 2.11 that no such term has a nf. 

Lemma 2.14. If {) f- M : (ILA:*.A) is provable, then M is not a nf. 

Proof. We show that M is not a hnf; by contraposition from Proposition 2.5, this 
implies that M is not a nf. 

Suppose that M is a hnf; we shall analyze its structure and see that it cannot 
possibly have the required type. M cannot be * because * is not of type UA:*.A 
(the type of * is •, and • «/» IL4:*.A, since both are nfs). By Lemma 2.7, M 
must be closed, therefore it cannot be a variable. M cannot be a II-abstraction 
because any well-typed II-abstraction has type *. 

If M is an application then, being a hnf, it must be of the form (Z TV), where 
Z is either *, a II-abstraction, or a variable. The first two cases are impossible 
because such terms can never have II-types, and therefore could not be used as 
operators in the (lie) rule. Since M is closed, Z cannot be a variable. 

If M is a A-abstraction, say \A:*.N, then by (Ili) it must be that (A:*) h 
N : A is provable. Again, TV cannot be * since * is not of type A. If A^ is a variable 
then, by Lemma 2.7, it must be A, but A is not of type A. N cannot be a A- 
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or II-abstraction because neither could be of type A. If N is an application then 
the analysis of the previous paragraph applies, except that Z cannot be a variable 
because the only declared variable is A, which does not have a II-type. ■ 



2.5. Some constructions 

We now define some of the constructs mentioned in §1, all of which are given 
in [Martin- Lof 1971]. Named A*-combinators will be defined in the following format: 

(fab) = M . 

This is shorthand for / = \a:A.\b:B.M for appropriate types A and B that can 
be inferred from the context. 

Pairs. An element of a pair, or product, type Ax B contains an element of type A 
and an element of type B. A pair type has an injection operation to create pairs 
of that type from elements of the component types, and two projection operations, 
one for each component. 

AxB = UX:*.(A^B^X)^X 

(pair AB)~ \a:A.\b:B.\X:*.\f:{A ^B^ X).f a b 

: A^B^(AxB) 

{left AB) = Xz:(A x B).z A (\a:A.\b:B.a) 
: (AxB)^A 

(right AB) = Xz:(A x B).z B (\a:A.\b:B.b) 
: (AxB)-^B 

This is essentially a typed version of the pairing combinator of the untyped A- 
calculus. For a : A and b : B, the following pairing axioms are easily verified: 

(left A B (pair A Bab)) - a 
(right A B (pair ABab)) = b 

This definition easily generalizes to tuples of arbitrary length [Reynolds 1985]. 

Unions. An element of a union, or sum, type A + B contains either an element 
of A or an element of 5, together with an indication of which kind of element 
it contains. A union type has one injection operation for each of the component 
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types, and a projection operation that allows the element within a union to be 
accessed in a type-safe way. 

A + B = UX: * .(A -► X) -+ (B -► X) -> X 
(inleft AB) = \a:A.\X: • .A/: A -► XA</:£ -► X/ a 

(inri^f A B) = XkB.XX: * . A/:A -► X.Xg:B -► X# a 
: B^(A + B) 

{case AB) = XX: • .A/: A -+ X.A</:£ -► XAz:(A + B).z X fg 
: nX*.(A^X)-+(5^X)^(A + B)->X 

For a : A, 6 : J3, a type X, and functions / : A~±X and 3 : B-+X, these definitions 
satisfy the following union axioms: 

(case ABX fg (inleft A B a)) = f a 
(case ABX f g (inright ABb)) - gb 

As with pairs, it is straightforward to generalize this definition to the union of an 
arbitrary number of types [Reynolds 1985]. 

Dependent pairs. A dependent pair type, also called a general sum or an existential 
type, is to an ordinary pair type as a dependent function type is to a simple function 
type. A dependent pair type is written Ex:A.#, with the £ binding x in B. An 
element of Ex: A. B can be thought of as a pair consisting of an element a : A and 
an element of type B[a/x]\ the type of the second element depends upon the value 
of the first. When treating dependent pairs as a defined notion, £ cannot be used 
as a binding operator; instead, it is a function that maps a type A and a function 
B of type A — » * into a type: 

(SAB)e IlX:*.(Ila:A.(Ba) -> X) -► X . 

The injection operation for dependent pairs is defined by the combinator 

(dpair AB) = Xa:A.Xb:(B a).XX:* .Xf:(Ila:A.(B a) -► X).f a b 
: Ua:A.(Ba)^(EAB) , 

which is much like the injection for pairing except that the type of b has been made 
dependent upon a. 
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The left element of a dependent pair, called the witness, can be extracted via 

(wit AB) = As:(£ A B).s A (\a:A.\b:(B a). a) 
: (EA£)->A, 

and it is straightforward to verify that 

(wit A B (dpair AB ab)) = a 

for a : A and b : (B a). 

The dependent pairs definable in the A*-calculus have no right-hand projection 
operation. One might try defining 

(dright AB) = As:(E A B).s (B (wit A B s)) (\a:A.\b:(B a).b) 
: Us:(EAB).B(witABs) , 

but dright does not have the indicated type; in fact, dright has no type in the 
A*-calculus. Attempting to typecheck the body of dright, under the declarations 
A : •, B : A — ► •, and s : (£ A B), we have 

s(witABs) : (lLa:A.(B a) -* (wit A B s)) -+(witABs) , 
(\a:A.\b:(Ba).b): (lla:A.(B a) ^ (B a)) ; 

the body of dright is the application of the first term above to the second, and this 
application is not well-typed. 

Although there is no right-hand projection for dependent pairs, the right-hand 
element can be indirectly accessed via the out operation, 

(out AB) = As:(£ A B).\X:*.\f:(Ua:A.(B a) -► X).s X f 

: (SAB)^ni:^.(na:A.(5a)^I)->I, 

which obeys the axiom 

(out A B (dpair A B ab) X f) - (/ ab) 

for a : A, b : (B a), a type X, and a function / : Ua:A.(B a) — > X. 

We shall make extensive use of dependent pairs in the construction of Girard's 
paradox. A generalization of dependent pairs to dependent tuples, i.e., elements 
of type YtX'.A.B, is described in §A. 

The above definitions of E, dpair, wit, and out can be used without change in 
the Calculus of Constructions [Coquand k Huet 1988], but the typing constraints 
of that system do not allow the witness of a dependent pair to be a type. A weaker 
form of dependent pair, which is definable in both calculi, allows the witness to be 
a type but lacks a witness operator. 
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2.6. Related systems 

The A*-calculus is a rather special-purpose system, having been adapted from [Mar- 
tin-LSf 1971] specifically for the investigation of dependent function types and the 
type of all types. In [Meyer k Reinhold 1986] we discussed a more flexible system, 
the A n -calculus, that was designed for the general study of dependent function 
types, both with and without the type of all types. For example, we considered an 
extension of the A n -calculus that would subsume the polymorphic A-calculus while 
preserving the properties lost when the type of all types is added. The design of 
the A n -calculus has been an ongoing project, evolving according to the needs of 
our research, and we do not wish to address here the complex issues involved in 
designing a truly general A-calculus with dependent types. Another advantage of 
the simplicity of the A*-calculus is that our results can be carried over to other 
systems by showing that they are conservative extensions of the A*-calculus. This 
is a straightforward task in many cases; it would not be as easy if the A*-calculus 
were more general. 

The A*-calculus and the A n -calculus differ in two ways. First, the context ma- 
nipulation rules of the A n -calculus are much like the thinning rules of Gentzen's 
sequent calculus [Kleene 1950]; there is no rule for context projection. We orig- 
inally thought that this method was superior to the style of the A*-calculus, as 
it does not require special empty statements to assert the well-formedness of a 
context. However, further experience with the proof theory of the A n -calculus and 
similar systems [Barendregt k Rezus 1983, Coquand 1985b] convinced us other- 
wise. The second difference is that the A n -calculus uses typed equations between 
A-terms rather than the untyped reduction used in the A*-calculus. This choice 
complicates the definition of the proof system for typing statements, since it must 
also contain inference rules for typed equations; the inference rules for contexts, 
typings, and equations are all interdependent and the system as a whole is more 
difficult to reason about. There are other situations in which typed equations are 
more appropriate (e.g., in the study of conservative extensions of algebraic theo- 
ries by typed A-calculi [Breazu-Tannen k Meyer 1987]), but for our purposes the 
simpler calculus suffices. 
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3. Looping with Girard's paradox 

3.1. The A*-calculus as a logic 

[Martin-L6f 1971] defines an intuitionistic type theory, i.e., a higher-order construc- 
tive logic, that is essentially equivalent to the A*-calculus. Central to this theory 
is the propositions- as-ty 'pes analogy, which establishes a connection between intu- 
itionistic logics and typed A-calculi. Also known as the 'formulae-as-types analogy' 
and the 'Curry-Howard isomorphism,' the analogy was first discovered for the case 
of positive implicational propositional logic by [Curry & Feys 1958] and extended 
to first- and second-order intuitionistic logic by [Howard 1969] and [Girard 1972]. 
Martin-Lof's type theory is based upon a particularly close reading of the anal- 
ogy, which we briefly review here. More general and complete presentations of the 
analogy can be found in [Stenlund 1972] and in [Huet 1986]. 

An intuitionistic type theory is a formal system for doing constructive rea- 
soning about constructible objects. By 'constructible objects' we mean effectively 
constructible objects, including effectively computable functions. As we have seen, 
a rich class of computable functions can be defined in the A*-calculus, and other 
constructible objects, such as pairs and unions, can be built up from functions. 
These functions and objects, classified by their types, make up the universe of 
discourse of Martin-Lof's type theory. 

In constructive reasoning, each logical connective is interpreted as a specifi- 
cation of a class of constructible objects. A proposition is proved by exhibiting an 
object in the class that it describes, so proofs themselves are constructible objects. 
It turns out that the relationship between a proof and the proposition that it proves 
is very much like the relationship between an object and its type, as shown in the 
table below. 

Proposition Proof Type 

P A Q A proof of P, and a proof of Q. P X Q 

P V Q A proof of P, or a proof of Q, and an P + Q 

indication of which is proved. 

P =^ Q An effective method for transforming P — > Q 

a proof of P into a proof of Q. 

Vx:A.P An effective method that, given any a IlxiA.P 

of type A, produces a proof of P[a/x]. 

3x:A.P A particular a of type A, and a proof Hx:A.P 

of P[a/x]. 
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This correspondence justifies the key idea of Martin- Lof's type theory: Propositions 
and types are identified, as are proofs and objects. Paraphrasing Martin-L6f, a 
proposition is the type of its proofs; conversely, a type is the proposition that is 
proved by exhibiting an object of that type. When using the A*-calculus as a type 
theory, we construct objects, which have types, and we prove propositions about 
them by constructing other objects, whose types are the propositions (according 
to the above correspondence) being proved. 

The type of all types plays a central role in Martin-Lof's type theory. Since 
types and propositions are identified, * is not only the type of all types, but also the 
type of all propositions.* A predicate is a parameterized proposition, so a predicate 
on a type A is just a function on A returning a proposition, i.e., a function of type 
A-+*. Relations are obtained by Currying; e.g., A-> A->* is the type of a binary 
relation on the type A. Higher-order predicates, i.e., predicates on predicates, 
can also be defined; e.g., a predicate on predicates on a type A is a function of 
type (A — ► *) — ► •. Higher-order quantification is expressible because the type of 
a quantifier-bound variable can be any term of type *, including * as well as the 
type of any predicate. Thus the absurd proposition VP.P translates directly into 
JL = UP:* .P; the negation of a proposition P is written ->P = P — » _L 

3.2. The paradox 

The informal construction of Girard's paradox given here is intended to serve as 
a guide to the full formal construction, given in §B. We give the essential formal 
definitions in this section and prove the required lemmas informally; a lemma 
numbered n.m in this section corresponds to lemma m in the full construction. 
To aid in the reading of the formal construction, we consistently use the outer 
parenthesization convention of A-calculus, e.g., (/ x), rather than the traditional 
mathematical notation, e.g., f(x). 

The essence of the paradox is this: In a type theory with quantification over all 
types, we can construct the set of well-founded sets. We can then define an ordering 
on well-founded sets and show that, under this ordering, the set of well-founded 
sets is a well-founded set that precedes itself— a contradiction. 

An ordered set A will be represented by a type A, a domain predicate dj, ' 
A — > *, and a (strict) ordering relation r^ : A — ► A — ► *. An element a : A is in 
the ordered set A iff (dj, a) holds. A will often be written in place of the three 
elements A, d^ and tj^ that represent A. We stress that this is a strictly visual 
device; in a term, A stands not for one term constructed from these three elements 



*Moreover, since * is itself a type, • is also a proposition. As a proposition, * is provable because 
there is a term, namely *, of type *, so * is a propositional constant that proves itself (!). 
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but exactly for 'A d A r A \ B is another ordered set represented by B, d&, and r#, 
and similarly for other calligraphic capital letters. 

An ordered set A is transitive iff its ordering relation is transitive: 

( Trans A) = ILr,y, z:A.(r A x y) -► (r A y z) -> (r A x z) . 

A predicate C : A — ► • on the elements of an ordered set .4 is a ciain iff there 
is a base element z : A such that z is in A and z satisfies C, and, for every x : ^4 
satisfying C, there is a y : yl satisfying (7 that is smaller than x: 

(Chain AC) = [S^A^z) x(Cz)] x [lLr:A(C *) -► Ey:A(C y) x (r^t/x)] . 

An ordered set is well-founded iff no chains exist within it, i.e., iff the existence of 
a chain implies absurdity: 

(WFA) = UC:A -> * . (Chain A C) -► JL . 

An ordered set .A is embedded into an ordered set # by a function f : A-> B 
and a bound element b : B iff b is in the domain of #, / is domain-preserving and 
monotonic, and the range of / is dominated by b: 

(Embed ABfb) = (d B b) 

x [Ux:A.(d A x)^(d B (fx)j\ 

x [iLr, y:A.(d A x) -> (^ y) -♦ fo s y) -► (r* (/ x) (/ y))} 

x [nx:A(^x)^(r 5 (/x)fe)] . 

The ordering on ordered sets is defined in terms of embedding: A is less than B iff 
there exists a function / and an element b such that / and b embed A into B. 

(Embed-ord AB)~ Ef:A -► B.Eb.B. Embed AB fb . 

We abbreviate (Embed AB f b) by A < fyh B, and (Embed-ord A B) by A < B. 

Two elements x and y of a type A are intensionally equal iff every predicate 
true of x is true of y: 

(Eq Axy)~ 11P:(A -+ *).(P x) -> (P y) . 

It is easy to show that intensional equality is reflexive, symmetric, and transitive. 
We shall abbreviate (Eq A x y) by x = j/ when A is obvious. 

To represent the ordered set of well-founded sets, we need a type U of ordered 
sets, a domain predicate d u : U -►* that is true only of the well-founded sets, and 
an ordering relation r u : U -> *7 -> * defined in terms of embeddings. Defining 
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U presents some difficulties, as we must somehow merge the three components A, 
dAi and ta representing an ordered set A into a single element of type U. It is 
tempting to use dependent pair types, but these cannot be made to work due to 
the lack of a right-hand projection. The solution is to arrange that the injection of 
a particular ordered set A into U is a predicate true of precisely those predicates 
true of A. Thus, defining OS-pred as the type of predicates on ordered sets, 

OS-pred = nA: * .( A -> *) -► ( A -► A -► *) -► * , 

we have U = OS-pred — ► *, and the injection inj is simply 

(injA) = XS:OS-pred.SA . 

If the injections of two ordered sets are intensionally equal, then any property true 
of the first is true of the second. 

Lemma 3.1. If (inj A) = (inj B) and (P A), then (P B). 

Proof. Apply the proof of (inj A) = (inj B) to (Xu:U.u P) and the proof of (P A). ■ 
The domain predicate on U is defined 

(d u u) = EA: • Xd A : A -> • .Hr A :A -► A -> * . 

(Eq U u (inj A)) x ( Trans A) x ( WF A) , 

and the ordering relation on U is defined 

(r u uv) = EA:*.Ed.A:A^*.Er4:j4-> A-**. 

(Eq U u (inj A)) x(EqUv (inj B)) 
x (Embed- ord AB) . 

We shall write U for the ordered set represented by U, du, and 77/. 

We now prove the lemmas necessary to show that U is a well-founded set. 
Most lemmas are stated informally, in which case a more formal version of the 
same statement follows in square brackets. 

Lemma 3.2, Any ordered set in U is transitive and well-founded. 
If (d u (inj A)) then ( Trans A) and ( WF A)] 



Proof. Follows from Lemma 3.1 and the symmetry of intensional equality. ■ 

Lemma 3.3. If A < B and B <f t5C ,b BC ^> then there exist f Ae and ^AC 
such that A <f AC ,b AC ^ an ^ ( r <? kAC bsc)- 
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Proof. Suppose that /as and b AB embed A into B. Let Jac = fsc ° Iab, and let 
6^ = (f BC b AB y It is straightforward to check that the required properties hold. ■ 

Corollary 3,4. The relation < is transitive. 
[UA<B and B < C, then A < C] 

The formal proofs of the remaining lemmas require uses of Lemma 3.1 and the 
properties of intensional equality; these will not be mentioned in the informal 
proofs given here. 

Lemma 3.5. U is transitive. [(Trans U).] 

Proof. Follows immediately from Corollary 3.4. ■ 

Lemma 3.6, U is well-founded. [(WF U)] 

Proof by contradiction. Suppose that C is a chain in U. The base of C is an 
ordered set, say Z, that satisfies cfo. By Lemma 3.2, Z is well-founded; we shall 
contradict this fact by using C to construct a chain D in Z. Define D to be the 
predicate 

Dee \a:Z.XY:*.Xd y :Y -+*.Zry:Y ^Y ^ + .Zf:Y -> Z. 
(C(injy)) X (Embed yZ fa) . 

To prove that D is a chain in Z, we must show that D has a base element ao : Z 
such that (dz ao), and that every element of Z in D has a predecessor in D. 

Let W be a predecessor of Z in C. Taking a to be the bound on the embed- 
ding from W to Z, we immediately see that (dz «o) and that cto is in D. 

If a : Z is in D, then there exists an ordered set y and a function / : Y — > Z 
such that 3^ is in C and y </ )fl 2. Furthermore, there must exist an X in C such 
that Af < y since y is i n C. By Lemma 3.3, we have an /' : X — ► Z and a' : Z 
such that A* <//y %• The predecessor of a in D is a'. ■ 

By Lemma 3.5 and Lemma 3.6, U is a transitive, well-founded set, hence U is 
in U, i.e., (du (injU)). 

Next we show that, under the embedding ordering, any ordered set in U is 
less than U. Given an ordered set A and an element a : A, the initial segment 
of A relative to a is the ordered set A a represented by the type A, the ordering 
relation r4, and the new domain predicate 

(d Aa x) = (d A x) x (r A x a) . 

Lemma 3.7. Any initial segment of an ordered set in U is itself in U. 
[if (du(inj A)) and (d^ a) for some a : A, then (cfe/ (mj A))-] 
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Proof. Let A be in U, and let a : A be such that (cU a). The initial segment A a 
is transitive because A is transitive; similarly, any chain in A a is clearly a chain 
in A. Hence A a is transitive and well-founded. ■ 

Lemma 3.8, A < U for any ordered set A in U. 
[If (J w (inj A)), then ,4 < U] 

Proof. Let .4 be in U, and let / : A -> (7 be the function mapping an element a : A 
to the ordered set A a - Then / embeds A into W with the embedding bound being 
A itself. A satisfies d u by hypothesis, and / is domain-preserving by Lemma 3.7. 
Let x and y be elements of A such that (r^ x y)\ the identity function embeds 
A x into A y with bound x, so / is monotonic. Similarly, for any element x of A, 
the identity function embeds A x into .4 with bound x, hence the range of / is 
dominated by A. ■ 

By Lemma 3.5, Lemma 3.6, and Lemma 3.8, we have that U < W, and thus 
(r u (injU) (injU)). The predicate 

Xw.U.(u = (inj U)) 

describes a chain in U\ The base of the chain is (inj U), and the predecessor of 
(inj U) is just (inj U). The existence of this chain contradicts Lemma 3.6, and 
leads to a proof of _L in the formal construction. 

3.3. Building a looping combinator 

Let Z denote the proof of _L obtained by constructing the formal proof of Girard's 
paradox; i.e., Z : (IL4:*.A). By Lemma 2.14, Z has no normal form, and hence 
the A*-calculus is not strongly normalizing. Reducing Z, we find that the following 
pattern emerges: 

Z = (lemma6 C c) -» (lemma2b • • •) 
-» (lemma6 • - •) 
-»► (lemma2b ...)->►.. . , 

where lemma6 is the formal proof of Lemma 3.6 and lemma2b is the formal proof 
of the second consequence of Lemma 3.2. To convert Z into a looping combinator, 
and thus harness this repetitive pattern, we make the following minor changes to 
the paradox construction. First, the absurd type _L is replaced by the type of 
polymorphic looping combinators, namely 

Loop = nA:*.(A— ► A) -> A , 
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in the definition of WF and in the formal proof of Lemma 3.7. With the redefinition 
of WF, Lemma 3.6 becomes 

UC.U -> * .(Chain U C) -► Loop ; 

the formal proof lemmaG of Lemma 3.6 must be changed so that, given a chain C in 
U and a proof that C is a chain, it returns a looping combinator. The redefinition 
of WF further implies that lemma2b, which is used in the body of Lemma 3.6, 
will also return a looping combinator. We thus modify lemma6 to take two more 
arguments, a type A and a function / : A —> A, and we change the body of lernma6 
to supply A and / as additional arguments to the proof of Lemma 3.2 and to 
apply / to the result of that application. In symbols, 

lemma6 = XC:II — ► * .Xc:(ChainU). 
■ ■ • (lemmaSb • • ■) 

is transformed into 

kmma6 = XC:U -> * .Xc:(OiainU).XA:* .A/:A -> A. 
. . . f ((lemmaSb ■ ■ •) A f) . 

Making these changes to Z yields an initial looping combinator Lo, which is called 
loop in §B. Reduction of Lo reveals the pattern 

(Lo A f) ->► (lemma6 C c A f) 

-» f((lemma2b • - •) A f) 

-» / (lemma6 • ■ • A f) 

-» f(f {(lemma2b • . ■) A /)) -» • • • , 

which is exactly the behavior required of a looping combinator. 

We have very convincing evidence that this cyclic pattern continues forever, 
i.e., that L is a true looping combinator. After 970,000 reductions of L by the 
LP program, we obtain the combinator 

L 69 - AA:*.A/:A^ Af 69 (L 70 A f) , 

which iterates the given function / at least 69 times. Up to this point, the number 
of reductions involved is exponential in the number of iterations obtained. (We 
were forced to stop after 970,000 reductions due to virtual memory limitations.) 

This empirical analysis of Lo is quite persuasive, but it does not constitute a 
proof that L is in fact a looping combinator. [Howe 1987] carried out a similar 
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construction of Girard's paradox with the assistance of the NUPRL proof develop- 
ment system [Constable 1986]. Howe applied the looping combinator construction 
method described above [Reinhold 1986], and proved that the resulting term is a 
true looping combinator by reasoning about its reduction behavior. More recently, 
[Coquand 1987] has proposed an argument that any term of type _L must behave in 
a regenerative manner similar to that of Z, and that it will do so forever. Assum- 
ing that this argument can be made rigorous, the correctness of our construction 
method follows. 

Theorem 3.9. Lq is a looping combinator. 
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4. Undecidability 

We now prove that the existence of looping combinators in the A*-calculus im- 
plies that the normal-form relation of the A*-calculus is undecidable, from which it 
follows that its equational and typing theories are undecidable as well. 

As our undecidability proof is somewhat novel, we wish to make it generally 
applicable. Therefore, we first prove the result for abstract reduction systems, of 
which all typed A-calculi are instances. We show that if a reduction system is rich 
enough to compute all total recursive functions, then the normal-form relation of 
the system is undecidable. We then show that a particular reduction system, a 
typed A-calculus with integers and looping combinators (the A -calculus), satisfies 
these requirements. Finally, we introduce a notion of embedding between reduc- 
tion systems and prove that embeddings preserve the computability of classes of 
functions; by showing how to embed A L into A*, we obtain the undecidability result 
for the A*-calculus. 

Henceforth, the term 'recursive function' will mean total recursive function. 



4.1. Reduction systems 

A reduction system is a three-tuple (i?, — >#, -r) consisting of a set R of terms, 
a binary reduction relation — ># C R x i?, and a binary application operation 
-r G R x i? — > R. The reflexive, transitive closure of — ># is written -»r. We shall 
write -r as though it were left-associative, and sans subscript when it is possible 
to do so unambiguously. A reduction system will often be specified by mentioning 
only its set of terms. 

A term M of a reduction system R is a normal form iff there is no N £ R 
such that M -*r N. 

The normal-form relation NF(i?) of a reduction system R is defined as 

NF(#) = {{M,N) eRxR\ M-» N and A^anf} ; 

i.e., the set of pairs of terms such that the first reduces to the second, and the 
second is a normal form. 

A reduction system with numerals is a four-tuple (iZ, — >r, •#, nurriR) such that 
(Rj -*R, 'r) is a reduction system and nurriR is a recursive bijection mapping inte- 
gers to normal forms of R; the range of nurriR is the set of numerals of R. The fact 
that nurriR is a bijection implies that the numerals are distinct, that every numeral 
is associated with a unique integer, and vice- versa. For an integer n, nurriR(n) will 
be written as L n^, dropping the subscript when the context determines R. 
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4.2. Undecidability in reduction systems 

We must first precisely define what it means for a recursive function to be com- 
putable in a reduction system. We say that a total numeric function <p G N* — ► N 
for some k > is numeralwise represent able [Kleene 1950] in a reduction system 
with numerals R if there is a term F £ R such that 

</?(m, n 2 , ■ ■ ■ , n k ) = m <=> F • jiu • L n 2j ■ . . . ■ L ^Jb_i "» l™j • (!) 

This definition is quite general in that it does not specify whether the i2-terms 
have types nor whether they are open or closed. If we define n = n\ , n<z, . . - , n^ for 
integers m (1 < i < ifc), define F ■ M = F • Mi • M 2 • . . . • M k for terms F and Mi 
(1 < i < fc) 5 and extend the numeral notation L J to work on vectors in the obvious 
way, then (1) becomes 

ip(n) = m <=> F • jij-* L m J . (2) 

The forward direction of (2) is often called definability [Barendregt 1984, 
p. 135]. Given a reduction system R and a recursive function </?, finding an F € R 
that defines ip is usually straightforward. But the fact that F defines </? does not 
imply that F completely characterizes ip; if F defines (p but does not numeralwise 
represent it (i.e., the reverse direction of (2) does not hold), then it is possible that 
F - jlj -*► L Xj for some x ^ m. 

One way to prove that such an F numeralwise represents tp is to show that the 
Church- Rosser property holds for R. However, a weaker condition suffices. Define 
the unique answer condition for a term F as 

F • jl A ->► L mi J5 F • L n_j -» L rn2j => mi — m<i . 

Then we have: 

Lemma 4.1. Let v? G N* — * N be defined by a term F in a reduction 
system with numerals. The unique answer condition holds for F iff F 
numeralwise represents (p. 

Proof. Straightforward. ■ 

While the Church-Rosser property applies to an entire reduction system, the 
unique answer condition applies only to the particular terms used to define par- 
ticular functions. Of course, if the Church-Rosser property holds for a reduction 
system i?, then the unique answer condition holds for all terms in R. 
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At the end of this section, we shall prove that the recursive functions are 
numeralwise representable in the A*-calculus. Once this is established, we have the 
undecidability result via the following: 

Theorem 4.2. If the recursive functions are numeralwise representable 
in a reduction system R, then NF(i?) is undecidable. 

Proof, Every decidable set has a recursive characteristic function and, by nu- 
meralwise representability, the graph of any such function is recursive in NF(i2). 
Therefore every decidable set is recursive in NF(i?). Now suppose that NF(E) is 
decidable. Then there is a recursive function T G N — ► N such that every de- 
cidable set is in TIME(T), the class of sets of deterministic time complexity T. 
But this contradicts the time hierarchy theorem of complexity theory [Hopcroft k 
Ullman 1979], so NF(i?) must be undecidable. ■ 

Representing partial functions. Why not prove the undecidability result by show- 
ing that the partial recursive functions are numeralwise representable in the A*- 
calculus? To begin with, the previous definition of numeralwise representability is 
not adequate for partial functions. If a partial recursive function <p is undefined at 
some argument vector n, to what shall the representing term F reduce when ap- 
plied to L n_,? We think of a A-term as having computed some value when it reduces 
to a normal form, so it is natural to propose that undefined values be represented 
by terms with no normal form.* 

If we accept this proposal, then we must ensure that F • jij has no normal 
form when <p(n) is undefined. Recall that in the A*-calculus, as in many reduction 
systems, there is more than one way to go about reducing a term; i.e., there are 
multiple reduction strategies. In particular, there is more than one way to proceed 
from F • jij. Hence, we must ensure that no reduction strategy allows F • Jij to 
reach a normal form when ip[n) is undefined. 

The minimalization operation is the only possible source of divergence in a 
partial recursive function expressed in terms of the initial functions and the stan- 
dard function-forming operations, and the only known way of implementing min- 
imalization in the A*-calculus is with a looping combinator. Therefore, to ensure 
that minimalization diverges when appropriate, we must ensure that the looping 
combinator itself, in any context, cannot reach a normal form under any reduc- 
tion strategy. The known results about looping combinators in the A*-calculus 

*Church made this identification early in the development of the untyped A-calculus; Barendregt 
and Wadsworth later suggested that undefined values be represented by terms with no head 
normal form (the so-called unsolvable terms) [Barendregt 1984, §2.2]. 
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only assert the existence of a single non-normalizing reduction path. If some un- 
tried strategy allows the looping combinator to reach a normal form, then a term 
representing a partial recursive function <p might have a normal form where <p is 

undefined. 

4.3. The A L -calculus 

The typed A-calculus with integers and looping combinators, the A L -calculus, is an 
instance of the finitely-typed A-calculus [Barendregt 1984, Appendix A]. Rather 
than use the traditional syntax, we prefer to use the syntax of A-terms given in §2. 
The only significant difference is that the type of a variable is not part of its name 
in our syntax; the type of a variable is given where it is bound, or by the context 
in the case of free variables. 

The A L -calculus has a single base type N, representing the natural numbers, 
and the following typed constants for integer arithmetic: 

: N zero constant 

s - ]\j _> jsj successor 

c : N — » N — ► N — > N conditional 

p : N — > N predecessor 

The numerals of A L are formed from and s. For any terms M and N, define 
(M° N) = N and (M i+1 N) = (M (M l JV)); then L i jL = (s'" 0). Each numeral 
is a normal form simply because none of the ^-reduction rules for the arithmetic 
constants, defined below, are applicable to numerals. 

(cOxy) — >l z 
(c(sz)xy) -> L V 
(PO)-LO 
(p (s* 0)) ^ L (s- 1 0) (i>l) 

The final line above is actually a reduction rule scheme, used here because the 
simpler rule 

(p(sx)) ^ L x 

expresses a stronger condition than is necessary. In particular, this rule is not 
satisfied by the predecessor combinator to be defined in the A*-calculus, which 
must mimic p in order to embed A L into A*. The A*-combinator, adapted from the 
polymorphic A-calculus, can compute the predecessor of a numeral, but it cannot 
compute the predecessor of (s x) when x is a variable. 
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The A L -calculus also has a countably infinite set of looping combinators. There 
is an initial looping combinator 

L : (N -► N) -► N 

and, for every looping combinator L 2 , there is a successor looping combinator L,-+i 
of the same type such that (Lj F) — >l F (Li+i F)- 
From the remarks made above, we have: 

Lemma 4.3. The A L -calculus is a reduction system with numerals. 
We shall also need: 

Lemma 4.4. Reduction in the A L -calculus is Church-Rosser. 
Proof. Follows immediately from [Barendregt 1984, Theorem 15.3.3]. ■ 

4.4. Representing recursive functions in the A L -calculus 

Closely following [Barendregt 1984, §6.4], we show that the functions that are 
numeralwise representable in A L include the recursive functions. For k > 1, define 



The type N* — ► N will be the type of a term representing a fc-ary numeric func- 
tion; rather than introducing cartesian product (tuple) types, the k arguments are 
"Curried." 

Say that a total function <p G N k — ► N is ^-representable iff it is numeralwise 
representable by a closed term of type N* — > N when the A L -calculus is viewed 
as a reduction system with numerals. The condition that F be closed and of the 
appropriate type is necessary because A L is a typed calculus and we shall construct 
new representing terms by applying and abstracting over previously constructed 
representing terms. 

In each of the propositions leading up to the main lemma, all of the real work 
involves proving that some recursive function is definable in A . That the function 
is also representable in A L follows immediately by Lemma 4.4 and Lemma 4.1. 

Proposition 4.5. The initial functions are A L ~representable. 
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Proof. For the successor function and the zero constant, simply use the successor 
and zero constants of A L . For < i < k, the i th projection function on fc-tuples is 
represented by the term 



If we define 



then (1) becomes 



Trf = Aa? :N.Axi:N. • • • .Ax*:N.x 2 . ■ (1) 

Xx :N k .M = Axi:N.Ax 2 :N. - ■ ■ .\x k :N.M , 
Trf = \x:N k . Xl . 



Proposition 4.6. The A L -representable functions are closed under 
composition. 

Proof, Let <p € N l — » N be defined by 

tp(n) = x(^i("), ^2(n), . . . , ^jfc(n)) . 

Assume that the ^-argument function x i s represented by a term G : N — > N, and 
that the /-argument functions ?/>i, ^2, . ■ • *l>k are represented by #1, #2, • • • , #jfc of 
type N* —> N. Then y> is represented by the term 

\x:T$ k .G (Hi x) {H 2 x)-.-(H h £).m 

Proposition 4.7. The A L -representable functions are closed under 
primitive recursion. 

Proof Suppose that <p G N /+1 — > N is defined by the primitive recursive scheme 

<?(n,0) = Xif0 
V?(n, k + 1) = ^(n, fc, v?(n, A:)) , 

that x 1S represented by a term G : N / — > N, and that ^ is represented by a 
term H : N /+2 — ► N. We shall compute y?(n, A:) by using a looping combinator to 
iteratively compute (p(n, k — 1). Letting 3/ stand for the arguments L n J3 define 

F = A/:N -► N.Ax:N.c x (G y) (# y (p x) (f (p a:))) . 

If we had a true Y combinator, then we could represent y? by (Ay:N .YF). How- 
ever, we only need the looping behavior here in order for F to work as required, so 
a looping combinator L t suffices. We shall show by induction on k that (p(y, k) is 
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represented by (Li F L feJ for any i. By A-abstraction, it follows immediately that 
<p is represented by (AyrN'.L; F L kj). 
For the basis, k = and we have 

Li F L A = L t FO 

- F (L,-+i F) 

-* cO (G y) (H y(pO) (U+t F ( P Q))) 
->Gy. 

Since G represents x by hypothesis, we have that (L* F L 0j) represents <p(y,0). 
For k + 1 > 0, we have 

L i F L fc + l J = L t -F(s L A; J ) 

-,^(L,- +1 ^)(s ,.«:,) 

-» c (s L *,) (G 0) (tf y (p (s ,_*,)) (L,-+i F (p (s L ^)))) 

-(^y(p(sA))(Li + iF(p(s L y))) 
^(ify^^Li+iF^)). 

By induction, we know that (L,-+i F L fc_,) represents (f(y>k); since if represents ^ 
by hypothesis, it follows that (L; F L k + 1_,) represents <p(y, fc + 1). ■ 

Proposition 4.8. The A L -representable functions are closed under 
minimalization. 

Proof. Suppose that tp £ N k — > N is defined by 

c/?(n) = [im.x{fi>,rn) = 

for a numeric function \ £ N* +1 — > N such that Vra.3m.x(rc, m) = 0. To compute 
¥>(n), we shall use a looping combinator to recursively check x(™ 5 0), then x(™> 1)? 
and so on until an m is found such that x(™, m) — 0. The search will always 
terminate because we have assumed that such an m exists. It is this assumption 
that restricts the representability result to the total, as opposed to partial, recursive 
functions. 

First, let us see how to search in the simple case when k = 0. 

Claim. Suppose that ip G N — > N is represented by P : N — ► N. Then 
there is a term search such that (Lo (search P) 0) -» L m J? where m — 
(/zm.-0(m) = 0). 
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Proof. Define 

search = \g:N -► N.A/:N -* N.Az:N.c (g z) z (f (s z)) . 

By induction on m - z, we prove that (Lj (search P) L i_,) -» L m_, if i < m. If m = i 
then if>(i) = 0; hence (P L i_,) -» and we have the following reductions: 

L t (search P) j A — ► (search P) (L;+i (search P)) L z_, 

-» c (P jj L ^ (Li+i (search P) (s J J) 
-^cOjj (Li+i (search P) (s L z_,)) 



L*J 



On the other hand, if i < m then if?(i) = n ^ (n exists because ^ i s total); 
therefore (P L z_,) -» L n_, and we have 

Li (search P) L z_, -» c (P L z_,) L i_, (Lj+i (search P) (s L i_,)) 
-» c l^j Jj (L{+i (search P) (s L i_,)) 
— ► Li+i (search P) (s jEJ 
= Lj+i (search P) J + lj . 

By induction, (L;+i (searc/i P) L i + lj -* L mj. Thus, if we begin searching at 0, 
(Lo (search P) 0) will reduce to L m_, since m > for any V>- ■ 

To complete the proof of the proposition, assume that \ ls represented by a 
term G : N* +1 — ► N. For a particular vector of arguments n, we can compute 
//m.x(w,m) = by defining ip(m) = x(^ m ) anc * computing fim.ij>(rn) = 0. Now 
(G L n_,) represents 0, therefore y> is represented by the term 

P = Ax:N*.L (search (G x)) . 

By the claim, (F L n_,) -» jum.x(™,m) = °j f° r an y ^- ■ 

Lemma 4.9. The recursive functions are A L -representable. 

Proof. By the preceding Propositions. ■ 

Corollary 4.10. The normal-form relation of the A L -calculus 
is undecidable. 

Proof By Lemma 4.9 and Theorem 4.2. ■ 
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4.5. Embedding reduction systems 

Let R and S be two reduction systems with numerals, and let trans r^s G R — > S 
be a translation function mapping terms of R to terms of 5. If M G R, then M 
abbreviates trans r^M). We say that trans R) s embeds R into S iff 

(1) For every m > 0, jfTji -»s L m _.S ? 

(2) For any M G i2 and n > 0, M -»# Jij ==> M -»s Jh, and 



(3) For M,N e R, M - R N = M -s N. 

In other words, the translation function preserves numerals and reduction paths 
ending at numerals, and commutes with the application operators. 

Lemma 4.11. Let T be a class of numeric functions numeralwise rep- 
resentable in R, If R can be embedded into S and, for every tp G T rep- 
resented by some F G i?, the unique answer condition holds for F G £, 
then the functions in T are numeralwise representable in S. 

Proof. Suppose that tp G N k — ► N is numeralwise represented by a term F e R. 
Then, for any n G N* and m G N, we have 

(^(n) = m «=>> F -ij L n jR -*jj L m JjR 
=> ^R^R^sJ^r , 

since i? can be embedded into 5. The embedding translation preserves numerals 
and commutes with term application in 5, therefore F *s L n J( s -»5 L m j5; so V* * s 
defined by ~F G 5. By Lemma 4.1, y? is in fact represented by F. ■ 

Corollary 4.12. If R can be embedded into S and the recursive functions 
are numeralwise representable in i?, then the normal-form relation of S 
is undecidable. 

Proof. By Theorem 4.2 and Lemma 4.11. ■ 

4.6. Undecidability in the A*-calculus 

We are now ready to prove that the normal-form relation of the A*-calculus is 
undecidable. We can compute on integers in A* by adapting the polymorphic 
Church numerals [Fortune et al 1983]. Define the numeral type 

N = II*:*.(t -+<)-> (*-*<) ; 
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then the numerals of A* are defined as 

L i J+ = \t:*.\f:t -+t.\x:t.f x , 

with the zero constant 6 ~ L Jir . By inspection, it is evident that the numerals 
are distinct and that each is a closed normal form. The A*-combinators for the 
successor and conditional operators are 

s = \n:N.\t:*.\f:t^>t.\x:t.f(ntfx) , 
c = An:N.Aa:N.A6:N.n N (Az:N.6) a . 

To define predecessor, we first need a special pairing operation on integers that is 
definable in terms of c. For terms M, N : N, define 

(M,N) = An:N.cn M N . 

The pair <M , N) is such that ((M, N) 6) -» M and ({Af, N) (s x)) -» N. The basic 
trick behind the predecessor operation is due to [Kleene 1979] and is explained 
in [Fortune et al 1983, p. 161]. 

p = An:N.n (N -. N) (A^:N -* N.((s (z 6)), (z 6))) (6, 6) (s 6) . 

From these observations, we have 

Lemma 4.13. The A*-calculus is a reduction system with numerals. 

Proposition 4.14. The reduction rules defined for the A L -constants c 
and p are observed by the A*-combinators c and p, and (s l 0) ->► L i J+ . 

Proof by verifying the appropriate reductions. To show (s l 6) -» J Jir , proceed by 
induction on z. ■ 

To embed the A L -calculus into the A^-calculus, we must define a translation 
not only on terms but on types as well, since A L -terms may contain types. The 
translation from A L -types to A*-terms is defined: 

N = N , 



A->B = Ilx:A.B . 

Because all A L -types are built from the base type N, there is no possibility that 
x will be free in 5, so we need not state this as a restriction. The A L -terms 
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are translated as follows, where L denotes the polymorphic looping combinator 
constructed in §3: 

= 6 

s = s 
c = c 

p = p 



L, = U (N -> N) -> N 

X = X 



(MN) = {MN) 



(Xx:A.M) = (\x:A.M) 

Lemma 4.15. The above translation embeds A L into A*, when these 
calculi are viewed as reduction systems. 

Proof. The translation obviously commutes with the application operators. To see 
that numerals are preserved, note that, by Proposition 4.14, 



J jL = (s'' 0) - (s l 0) 



r * L fr J* 



To show that M -»l l^j => M -»* jT^ we proceed by induction on the length of 
the A L -reduction path from M to jx A . If M — >l N by a ^-reduction, then the same 
/3-reduction will take place in A*. If M — >l N by one of the arithmetic constant 
reduction rules, then, by Proposition 4.14, a chain of one or more ^-reductions 
will take M to ~N in A*. If M — >l N by a looping combinator reduction, then, by 
Theorem 3.9, a chain of one or more /^-reductions will take M to N in A*. ■ 

Theorem 4.16. The normal-form relation of the A*-calculus 
is undecidable. 

Proof. By Lemma 2.1, Lemma 4.9, Corollary 4.12, and Lemma 4.15. ■ 
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5. Conclusion 

The main results of this thesis can be summarized as follows. 

• A family of polymorphic looping combinators can be constructed 
in the A*-calculus. 

• The existence of these looping combinators implies that the re- 
duction, equational, and typing theories of the calculus are all 
undecidable. 

We now discuss some practical and theoretical consequences of these results. 

Dependent function types in programming languages. The failure of strong normal- 
ization and the undecidability of the reduction and equational theories of terms is 
not surprising for real programming languages, because in such languages we expect 
to be able to express possibly divergent recursive computations using primitives 
such as letrec. Furthermore, since typechecking may require arbitrary computa- 
tion, typechecking will be undecidable for a language with recursion and dependent 
function types whether it has a type of all types or not. 

This might seem to disqualify dependent function types as a useful feature of 
practical programming languages, but there are a number of ways to make them 
more palatable. One extreme is taken by CLU, in which parameterized procedures 
are similar to functions with dependent types. In CLU, a parameterized procedure 
can be applied only to a type or to a constant expression of some built-in type, the 
value of which can be computed at compile time. At the other extreme, a clever 
compiler could, in principle, detect any recursive computation that arises during 
typechecking by watching for invocations of letrec or other recursion constructs. 
Upon detecting a recursive computation, the compiler could either warn that the 
compilation may not terminate or simply refuse to compile the program. 

The primary consequence of our result for programming language practice is 
that this latter strategy will not work for a language with recursion that subsumes 
the A*-calculus. Recursive computations can be expressed in such a language using 
looping combinators, which cannot be detected by a compiler. One might object 
that it is unlikely that a programmer would, intentionally or otherwise, formalize 
Girard's paradox and thereby subvert the typechecker, but we do not know that 
simpler looping combinators do not exist. 

Dependent pair types. As we saw in §3, dependent pair types correspond to ex- 
istential propositions under the propositions-as-types analogy. Dependent pair 
types seem to have first appeared in [Howard 1969], who distinguished between 
weak dependent pairs, which only have an out-like accessing operation, and strong 
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dependent pairs, which have both left- and right-hand projections. (Having a left- 
hand projection and out, but lacking a right-hand projection, the dependent pairs 
definable in the A*-calculus lie between the two.) 

[Mitchell k Plotkin 1985] observe that implementations of abstract data types 
in languages such as Ada, CLU, and ML can be modelled by weak dependent pairs. 
[MacQueen 1986] argues that weak dependent pairs are not flexible enough for 
full-fledged "programming in the large," and proposes instead the use of strong de- 
pendent pairs. Unfortunately, the familiar polymorphic A-calculus of [Girard 1972] 
and [Reynolds 1974] augmented with strong dependent pairs admits the formal- 
ization of Girard's paradox, which implies the failure of strong normalization, the 
ability to construct looping combinators, and thereby the undecidability of nor- 
mal forms, equality, and typing. This was discovered simultaneously by [Harper k 
Mitchell 1986] and [Hook k Howe 1986], who demonstrated that the A*-calculus 
can be simulated in the polymorphic A-calculus with strong dependent pairs, and 
by [Coquand 1986], who argued that Girard's paradox can be carried out in such a 
language directly. The difficulties stemming from Girard's paradox can be avoided 
either by retreating to weak dependent pairs, or by settling for a less flexible form 
of polymorphism [Mitchell k Harper 1988]. 

Kernel languages. Our interest in programming languages with dependent function 
types and the type of all types was originally sparked by [Burstall k Lampson 1984], 
which describes Pebble, a "kernel language" for abstract data types and modules. 
Pebble is a richer language than the A*-calculus; it supports dependent function 
types and the type of all types, but it also includes recursion, integer and boolean 
base types, tuple types, and strong dependent pairs. Yet the type system of Pebble 
does not seem to have the full power of that of the A*-calculus. One major difference 
is that Pebble does not allow a-conversion in dependent function types, so that 
Hx\A.B and Uy:A.B[y/x] are considered to be two distinct types. The A*-calculus, 
which does not make this distinction, cannot be simulated under this restriction, 
and so our results for the A*-calculus are not directly applicable to Pebble. 

Related to Pebble is the typed A-calculus of [Cardelli 1986], which is essentially 
the A*-calculus enriched with strong existential and recursive types. This language 
subsumes the A*-calculus, so our results extend to it trivially. 

5.1. Context and history of this work 

In [Meyer k Reinhold 1986] we claimed the existence of a polymorphic fixed-point 
combinator in a typed A-calculus essentially equivalent to the A*-calculus. Shortly 
before that paper was presented, I found two major flaws in the construction of the 
combinator. First, the construction relied upon features not present in the pure 
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calculus. My construction was based on the presentation in [Martin- Lof 1972], 
which implicitly uses a richer language that contains strong dependent pairs and a 
flexible primitive recursion operator for functions on integers. It appears that nei- 
ther of these constructs can be simulated in the pure A*-calculus, although this has 
not been proved. Second, even under the assumption that these features existed, 
I could not find a convincing, rigorous proof that the constructed term really was 
a fixed-point operator. On the positive side, I observed that the constructed term 
was a polymorphic looping combinator [Reinhold 1986], and I conjectured that the 
construction would lead to a true fixed-point combinator when carried out in the 
pure system. 

In the fall of 1985 we learned that Thierry Coquand had constructed, and 
checked by machine, a formalization of Girard's paradox in an extension of his 
Calculus of Constructions [Coquand 1985a], Encouraged by this result, in the 
spring of 1986 I began working from a preprint of [Coquand 1986] and from [Gi- 
rard 1972] to obtain a formalization of the paradox in the pure A*-calculus. It had 
been apparent beforehand that machine assistance would be required in order to 
completely check the formal construction. Even the original construction, carried 
out in a richer language, requires about five pages to write down, and checking 
it by hand is a tedious and error-prone process. The obvious complexity of the 
construction in the pure A*-calculus lead to the initial design and development of 
LP in the summer of 1986. With this system, I checked my original construction 
and empirically verified that it loops under reduction. 

In the meantime, Doug Howe had been working on formalizing and analyzing 
Girard's paradox with the aid of the NUPRL proof development system [Consta- 
ble 1986]. In the fall of 1986 a preprint of [Howe 1987] arrived, in which a more 
complete formulation of the paradox than given in [Coquand 1986] is presented. 
Howe applied my looping combinator construction method and proved that he 
obtained a looping combinator that was not a fixed-point operator. 

Using Howe's formulation of the paradox, I was quickly able to complete my 
own formalization with the aid of LP and verify that our method was applicable 
to it, obtaining the looping combinator Lo. The paradox and the construction 
method were presented in §3, and a complete listing of Lo is given in §B. In light of 
Howe's proof and Coquand's more recent argument, mentioned in §3, it does not 
seem worth duplicating their work in order to rigorously prove that Lo is in fact a 
looping combinator. 

An important detail that has been missing from the published work on looping 
combinators in the A*-calculus is the fact that the existence of a looping combina- 
tor does not immediately imply the undecidability of normal forms, equations, and 
typings in the calculus. Indeed, as discussed in §4, the obvious method for prov- 
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ing undecidability, namely by showing that all partial recursive functions can be 
computed, relies upon knowing more than we do about the reduction behavior of 
looping combinators in the A*-calculus. In §4 we proved by an alternative method 
that normal forms, equations, and typings are undecidable in the A*~calculus. 

5.2. Open questions 

The claim of [Meyer k Reinhold 1986] that fixed-point operators exist in the A*- 
calculus was premature, leaving open the following question: 

(1) Do fixed-point operators exist in the A*-calculus? 

It seems likely that a nonexistence proof will require semantic rather than syntactic 
methods. 

A major theme of [Meyer k Reinhold 1986] that we have not addressed here is 
the conservative extension of algebraic theories by typed A-calculi [Breazu-Tannen 
k Meyer 1987, Breazu-Tannen 1987]. An algebraic theory is conservatively ex- 
tended by a typed A-calculus if, when the function symbols and axioms of the 
theory are added to the calculus, the equations provable between algebraic terms 
in the calculus are just those that were provable in the original theory. The value 
of conservative extension theorems for reasoning about programs is that they al- 
low the familiar methods of equational reasoning to be used instead of the more 
complex methods that have been developed for reasoning about divergent computa- 
tions [Gordon et al. 1979, Paulson 1984]. In [Meyer k Reinhold 1986] we concluded 
that the A*-calculus does not conservatively extend every algebraic theory, but this 
claim depends upon the existence of a fixed-point operator. The unknown status 
of fixed-point operators and the presence of looping combinators in the A*-calculus 
raises the question: 

(2) Do looping combinators conservatively extend algebraic theories? 

To start, one might consider whether the A L -calculus of §4 is a conservative exten- 
sion of every algebraic theory. 

We mention here that a related open question of [Meyer k Reinhold 1986] has 
been answered: The pure A*-calculus is a conservative extension of the pure A - 
calculus, the typed A-calculus with dependent function types [Breazu-Tannen 1986]. 

Finally, a more pragmatic question is: 

(3) Are dependent function types useful of themselves, in the ab- 
sence of the type of all types or similar constructs? 

While dependent types are not explicitly available in many current programming 
languages, they occur implicitly in a variety of ways. For example, a well-known 
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limitation of procedures in Pascal is the restriction that an array parameter must 
be of a fixed size that can be determined at compile time. Many implementations 
of Pascal overcome this problem by extending the procedure call mechanism so that 
the dimensions of an array are passed along with the array itself; the dimensions 
are made available to the called procedure via special "dimension" variables. 

There are many examples of interesting functions in real programming lan- 
guages that are typically untyped or weakly typed, but which can be accurately 
described by dependent types. Consider the format procedure available in most 
dialects of Lisp [Steele 1984] (equivalently, the printf procedure of C [Kernighan 
& Ritchie 1978]). Format is applied to a format string and some number of ar- 
guments, and patterns in the format string specify how the arguments are to be 
printed. While the first argument to format must be a string, the types of the 
remaining arguments depend upon the particular patterns given in the string. If 
we think of format as a function mapping a string to another function that will 
actually perform the output, then format can be given a dependent type, since the 
type of the returned function depends upon the value of the string argument. 
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A. The LP program 

A.l. Data structures and algorithms 

The core of the LP program is a reduction engine for typed A- terms. Terms are 
represented as graphs, much as in [Wadsworth 1971], and reduction is performed 
by a closure-based algorithm similar to that of [Aiello k Prini 1981]. 

Once reduction is implemented, it is a simple matter to implement a type 
derivation algorithm that computes the type, if any, of an arbitrary term. Due to 
the type conversion (tc) rule, the proof system for typing statements presented in 
§2 is non-deterministic. However, it is not hard to demonstrate that any provable 
typing statement has a proof in which the (tc) rule is used only at the very end of 
the proof or immediately before the (lie) rule, to convert the type of the operand 
of an application. This observation leads to the algorithm shown below, expressed 
as a recursively defined function T of type context — > term — > term. The algorithm 
traverses an input term by recursive descent, extending the context A whenever 
an abstraction term is entered. 

TA(x) = if x e domA 
then A(x) 
else error: undeclared variable x 

TA(*) = * 

TA(ILr: A.B) = if TA(A) ^ • 

then error: type of declared variable is not of type * 
elseifT(A,x:,4)(5)^* 

then error: II-body does not have type • 

else • 

TA(Ax:A.£) = ifTA(A)^* 

then error: type of declared variable is not of type • 
else (Tlx:A.T(A,x:A){B)) 

TA{M N) = let A = TA(M) and B = TA(N) 
in if -^pi-terml(A) 

then error: operator does not have a II-type 
else if bound-var-type(A) «/>► B 

then error: ill-typed application 
else pi-body(A)[N/x] 
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A. 2. Syntax and sugar 

The notation for terms of the A*-calculus presented in §2 is pleasant enough for 
human consumption, but it takes some time to teach a computer how to read it. 
As LP was written in Lisp, and we already have text editors with powerful facilities 
for editing Lisp-like programs, it was decided to use the list-reading facilities of 
the Lisp implementation to parse terms input to LP. Thus the LP input language 
is different in appearance from the usual notation. Variables of the A*-calculus 
are represented by symbols in LP (alphabetic case is significant); beyond that, the 
correspondence is: 



(Xx:A.M) 


(\x A M) 


(Ux-.A.B) 


(\x A B) 


(M N) 


(M N) 



Some syntactic sugar is denned. Application, as usual, is left-associative, so 
(/ a b) is equivalent to ((/ a) 6). An abbreviation for (!x A B) is (A -> B) 
if x does not occur free in B; '->' is right-associative. A chain of A-abstractions 
such as (\x A (\y B (\z C ...))) may be abbreviated: 

(\ CCx A) 

(y B) 

(z C)) 

...) 

Chains of Il-abstractions may be abbreviated in a similar fashion. The let con- 
struct 

(let ((a: A M) 
(y B N) 
U C 0)) 

is sugar for the application 

C(\ (Car A) 
(y B) 
iz C)) 

M N 0) . 

Like Lisp's "read-eval-print" loop, LP has a top-level "read-type-eval-print" 
loop that reads a term, attempts to compute its type, and, if the term is well- 
typed, prints its type and its normal form. Certain symbols are predefined as LP 
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commands; the most important of these is the def command. A term of the form 
(def x M) defines the symbol x in the global environment to be the term M, 
if M is well-typed. After this definition, any free occurrence of x, in any term, 
will refer to M. Terms in the environment are kept in normal form for efficiency, 
but some terms (e.g., any looping combinator) do not have normal forms. The 
def x command is used in such cases; it works just like def except that it does not 
attempt to reduce the defined term to normal form. 

LP has a macro facility that is used to define local abbreviations within the 
paradox construction (they are also used in the implementation of dependent tu- 
ples, described below). A term of the form 

(mlet ((xi Mi) (x 2 M 2 ) ■•• (x* AT*)) N) 

expands into N[M/x]. Macros are expanded from the outside inwards, and ex- 
pansion takes place before typechecking is done. 

A. 3. Dependent tuple types 

The formulation and proof of Girard's paradox makes frequent use of dependent 
pair types. The paradox could, in principle, be formalized using the definitions 
of §2, but the resulting term would be rather complex. Certain propositions of 
the paradox are expressed as nested dependent pair types, entailing corresponding 
nested uses of out to get at the innermost dependent component of an element of 
such a type (e.g., consider 77/, in which dependent pair types are nested six deep). 
Each use of out must mention the result type X of the function / that accesses the 
components of the dependent pair;* moreover, the dependent parts of most of the 
dependent pair types used in the paradox are themselves composed of conjunctions 
of two or three types. 

The complexity of terms involving nested dependent pair types motivated the 
introduction of dependent tuple types, a generalization of dependent pair types 
that is supported in part by the macro expansion mechanism of LP. An element 
of a dependent tuple type can be thought of as a record containing named fields 
a\\A\, 122:^2, . . . , a n :A n in which the type U of field a,* can depend upon the values 
of the preceding fields a\, 02, . . . , fli-i- Dependent pair types can also be param- 
eterized, and the type of each parameter may depend upon the values of pre- 
vious parameters. (This parameterization could have been done with ordinary 
A-abstraction, but it was more convenient for the paradox construction to include 
it as part of the dependent tuple type construct.) 

*Uses of out, which require mentioning the type A and the function B, can be eliminated by 
directly applying a dependent pair to the desired X and /, but X must still be given. 
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A dependent tuple type is declared to LP by a command of the form 

(def-dtuple (G ((pi si) Cj>2 * 2 ) "" &* 5 *^ 
((ai ti) (a 2 <2> •*■ ( a n *n))) 5 

where G is the name of the tuple type, each parameter pi has type $j, and each 
field a^ has type ij. The declaration of a tuple type G causes three things to be 
defined: G is bound to a term describing the actual type of the tuple, ~G is bound 
to a constructor function that produces an element of the tuple when applied to 
actual parameters and field values of the appropriate type, and SG is bound to 
an accessor macro that can be used to "open up" an entire tuple with a single 
operation, allowing a field a of a tuple variable x to be accessed as x.a. 
Specifically, the above declaration causes G to be defined as 

G = \p:s.IlX:*.(ILa'I.X)^>X , 

and the constructor function ~G to be defined as 

-G = \p:s.\a:Z\X:*.\f:(na:t.X).fS 
: Up:s.Ua:LGp. 

Finally, the accessor macro ®G is defined so that (<0G x q AM), for some variable 
x of type (G 5), expands into 

(x A (Xx.ai:ti[xTa/a][q/p] 

(\x.a,2:t2[x7a/a][q/p] • • ■ 

(Ax.a n :i n [a;Ta/o][g/p].M)---)) > 

where t[x~!a/a] denotes the simultaneous substitution of x.a{ for a; in t (1 < i < n). 
In words, the application of @G evaluates the body M of type A in an environment 
with x.ai bound to the appropriate element of x, for each declared field a%. 
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B. The looping combinator 

; ; ; polymorphic looping combinator type 
(def Loop (!Z * ((Z -> Z) -> Z>>) 

; ; ; type of relations on a type A 
(def Rel (\A * (A -> A -> *))) 

; ; ; type of predicates on a type A 
(def Pred (\A * (A -> *))) 



; ; ; transitivity 

(def Trans (\ ((A *) 

(dA (Pred A)) 
(rA (Rel A))) 
(!x A (!y A (!z A ((rA x y) -> (rA y z) -> (rA x z))))))) 



; unused argument, to get Trans: OS-pred 



; ; ; chains 

(def-dtuple (Predec ((A *) 

(dA (Pred A)) 
(rA (Rel A)) 
(C (Pred A)) 
(x A) 

(ex (C x))>) 
<(y A) 
(cy (C y)) 
(ryx (rA y x)))) 



; predecessor existence predicate 



in chain C, 
for every x 
in the chain, 
there is a y 
that is in the chain 
and smaller than x 



(def-dtuple (Chain ((A *) 

(dA (Pred A)) 
(rA (Rel A)) 
(C (Pred A)))) 
((z A) 
(cz (C z)) 
(dz (dA z)) 
(pr (! <(x A) 

(ex (C x)>) 
(Predec A dA rA C x ex))))) 



chain C 
base of chain 
base is in chain 
base is in A 
predecessors exist 
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; ; ; well-f oundedness 

(def WF (\ ((A *) 

(dA (Pred A)) 
(rA (Rel A))) 
(!C (Pred A) ((Chain A dA rA C) -> Loop)))) 



; ; ; embedding ordered sets 

(def-dtuple (Embed ((A *) 

(dA (Pred A)) 
(rA (Rel A)) 
(B *) 

(dB (Pred B)> 
(rB (Rel B)) 
(f (A -> B>) 
(b B))) 
((db (dB b)) 
(pres-dom (!x A ( (dA x) -> (dB (f x))))) 
(mono (!x A (!y A ( (dA x) 

-> (dA y) 

-> (rA x y) 

-> (rB (f x) (f y)))))) 



embedding function 
embedding bound 
b is in domain of B 
f is domain-preserving 
f is monotonic 



(dominate (!x A ((dA x) -> (rB (f x) b)))))) ; b dominates ran f 



ordering on ordered sets based on embedding 



(def-dtuple (Embed-ord ((A *) 

(dA (Pred A)) 
(rA (Rel A)) 
(B *) 

(dB (Pred B)) 
(rB (Rel B)))) 
((f (A -> B)> 
(b B) 
(m (Embed A dA rA B dB rB f b)))) 



embedding function exists 

embedding bound exists 

together they define an embedding 
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; ; ; iat«wi«Ml •qulity (direct** trm hft to ri#rt) 
(<*•* Eq (\ «A •) 

i* i) 

Cj A)> 
(t? (t*«d A) CO *> -> (f y>»» 



; ; ; intMuioart (fHUty is r«fl«civ*. ij— i ir ie, ■* ts«M»l*« 

(<M «q-r«f <\ «A»> 
<* A» 

(: (Eq In) 

<\ «* c»**a a» 
(t (r*>» 
»»» 



(d«i «t-sya (\ «A *> 
(x A) 
(JA) 

(• (IqAft y>» 
(: <Eq *y«l 

<• (\« A (Eq A « x)) 
(•q-w* A s)»» 

(dai •qrtrau <\ ((A *) 
<xi) 
<yA> 
(*A) 
(f <Eq A l J)) 

(q<Eq*y«»> 
(: (EqAxx) 

Cq (\« A (Eq A x »)) p)))) 
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;;; universal type of ordered sets, and the injection into it 

(def QS-pred (!A * ((Pred A) -> (Rel A) ->*))) ; type of predicates on ordered sets 

(def U (OS-pred -> *)) ; type of predicates on OS-predicates 



(def inj (\ ((A *) 

(dA (Pred A)) 
(rA (Rel A))) 
(: U 

(\x OS-pred 

(x A dA rA))))) 



; injection into U 



;;; Lemma 1. If (inj OA) = (inj OB) and (P OA) , then (P OB). 

(def lemmal (\ ((A *) 

(dA (Pred A)) 
(rA (Rel A)) 
(B *) 

(dB (Pred B)) 
(rB (Rel B)) 

(e (Eq U (inj A dA rA) (inj B dB rB))) 
(P OS-pred) 
(pA (P A dA rA))) 
(: (P B dB rB) 

(e (\u U (u P)) P A)))) 



; domain predicate on U: transitive, well-founded ordered sets only 



(def-dtuple (dU ((u U))) 
((A *) 
(dA (Pred A)) 
(rA (Rel A)) 

(e (Eq U u (inj A dA rA))) 
(t (Trans A dA rA)) 
(w (WF A dA rA)))) 



; ordered set OA exists 



; u = (inj OA) 

; OA is transitive 

; OA is well-founded 



; ; ; ordering on elements of U: by embedding 

(def-dtuple (rU ( (u U) 

(v U))) 
((A *) 
(dA (Pred A)) 
(rA (Rel A)) 
(B *) 

(dB (Pred B)) 
(rB (Rel B)) 

(i (Eq U u (inj A dA rA))) 
(j (Eq U v (inj B dB rB))) 
(o (Embed-ord A dA rA B dB rB)))) 



; ordered set OA exists 



; ordered set OB exists 



u = OA 
v = OB 
OA < OB 



ifPWiiwpil^ppwi^ 
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;;; L«na 2«. If G8J (inj 04)) » then (Trans OA). 

(d«f Imu2i 
(\ (U ♦) 

(dA <Pr«d A)) 
(rA 0U1 A)) 
(d (<iJ (inj A dA rA)))) 
(td&d 

(inj A dA rA) 
(Treat A dA rA) 
; ; apply laamal 
(lMtl d.A d.dA d.rA 
A dA rA 



<«F*J* U (inj A dA rA) (i*j d.A d.dA d.rA) d,«) 

Traaa . 

d.t)))) 



2b. tf OKI (inj OA)), then (WF OA). 
;;; Identical in atractara to l«a»*2a» «*€•#* for ra*ult. 



(d«f lawutfb 
(\ ((A ♦) 

(dA (Fr«4 A)) 
(rA (Bdl A)) 
(d GttJ (inj AdArA)))) 
(Mild 

(inj A dA rA) 
(W A dA rA) 
; ; apply l«v*l 
(li«ul d.A d,dA d.rA 
A dA rA 
(«*-*?» S {inj A dA rA) <inj d.A d.dA d.rA) d.») 

•r 

d.»)))) 
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;;; Lemma 3. If OA < OB, and fBC, bBC embed OB into OC, then there exist fAC, bAC 
;;; embedding OA into OC such that (rC bAC bBC). 

(def-dtuple (L3-conseq ((A *) ; type of consequence of lemma3 

(dA (Pred A)) 

(rA (Rel A)) 

(C *) 

(dC (Pred C)) 

CrC (Rel C)> 

(bBC C))) 
((f (A -> O) 
(b C) 

(m (Embed A dA rA C dC rC f b)) 
(rb (rC b bBC)))) 



(def lemma3 
(\ ((A *) 

(dA (Pred A)) 

(rA (Rel A)) 

(B *) 

(dB (Pred B)) 

(rB (Rel B)) 

(C *) 

(dC (Pred «) 

(rC (Rel C)) 

(oAB (Embed-ord A dA rA B dB rB)) 

(fBC (B -> C)) 

(bBC C) 

(mBC (Embed B dB rB C dC rC fBC bBC))) 

(mlet ((RT (L3-conseq A dA rA C dC rC bBC))) ; result type 
(8Embed~ord ; open oAB 

oAB 

A dA rA B dB rB RT 

(©Embed ; open oAB.m 

oAB.m 

A dA rA B dB rB oAB.f oAB.b RT 

(fiEmbed ; open mBC 

mBC 

B dB rB C dC rC fBC bBC RT 

(mlet ((f (\x A (fBC (oAB.f x)))) ; function mapping A -> C 
(b (fBC oAB.b))) ; upper bound on its range 

("L3-conseq A dA rA C dC rC bBC ; construct consequence 
f 
b 

; ; embedding of A into C 
("Embed A dA rA C dC rC 
f b 

;; b in domain of C 
(mBC.pres-dom oAB.b oAB.m.db) 
; ; f preserves domain 
(\ ((x A) 

(dx (dA x))) 
(mBC.pres-dom (oAB.f x) 

(oAB.m.pres-dom x dx))) 



THE LOOPING COMBINATOR 53 



; ; f is monotonic 
(\ ((x A) 
(y A) 

(dx (dA x)) 
(dy (dA y)) 
(rxy (rA x y))) 
(mBC.mono (oAB.f x) 
(oAB.f y) 

(oAB.m.pres-dom x dx) 
(oAB.m.pres-dom y dy) 
(oAB.m.mono x y dx dy rxy))) 
; ; ran i dominated by b 
(\ ((x A) 

(dx (dA x))) 
(mBC.mono (oAB.f x) 
oAB.b 

(oAB.m.pres-dom x dx) 
o AB . m . db 

(oAB.m. dominate x dx)))) 
; ; proof that (rC b bBC) 
(mBC. dominate oAB.b oAB .m.db) ))))))) ) 



; ; ; Corollary 4. Embed-ord is transitive. 

(def cor4 
(\ ((A *) 

(dA (Pred A)) 

(rA (Rel A)) 

(B *) 

(dB (Pred B)) 

(rB (Rel B)) 

(C *) 

(dC (Pred C)) 

(rC (Rel C)) 

(oAB (Embed-ord A dA rA B dB rB)) 

(oBC (Embed-ord B dB rB C dC rC))) 

(mlet ((RT (Embed-ord A dA rA C dC rC))) ; result type 
(GEmbed-ord oBC 

B dB rB C dC rC RT 

(let ((1 (L3-conseq A dA rA C dC rC oBC.b) 
(lemma3 A dA rA B dB rB C dC rC 
oAB oBC.i oBC.b oBC.m))) 
(8L3-conseq 1 

A dA rA C dC rC oBC.b RT 
("Embed-ord A dA rA C dC rC 
l.f 
l.b 
l.m))))))) 
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; ; ; Lemma 5. (Trans OU) . 

(def lemmaB 
(\ «ul U) 
(u2 U) 
(u3 U) 

(r (rU ul u2)) 
(s (rU u2 u3))) 

(mlet ((RT (rU ul u3))) 
(«rU 
r 

ul u2 RT 
(®rU 



; result type 
; open r 



open s 



construct consequence 



; by transitivity of Embed-ord 



u2 u3 RT 
("rU ul u3 

r.A r.dA r.rA 
s.B s.dB s.rB 

;; proof that ul = (inj r.OA) 
r. i 

;; proof that u3 = (inj s.OB) 
s.j 

;; (Embed-ord r.OA s.DB) 

(cor4 r.A r.dA r.rA 

s . A s . dA s . r A 

s.B s.dB s.rB 

; ; r.OA < s.OA follows from r.OB = s.OA and r.o : r.OA < r.OB 
(lemmal r.B r.dB r.rB ; connects r.OB to s.OA 
s.A s.dA s.rA 

;; proof that (inj r.OB) = (inj s.OA) 

(eq-trans U (inj r.B r.dB r.rB) u2 (inj s.A s.dA s.rA) 
;; proof that (inj r.OB) = u2 
(eq-sym U u2 (inj r.B r.dB r.rB) r. j) 
s.i) ; proof that u2 = (inj s.OA) 
;; OS-pred true of r.OB; lemmal will prove it for s.OA 
(\ ((X *) 

(dX (Pred X)) 
(rX (Rel X))) 
(Embed-ord r.A r.dA r.rA 
X dX rX)) 
;; proof that above OS-pred is true of r.OB 
r.o) 
; ; proof of s.OA < s.OB 
s.o))))))) 



THE LOOPING COMBINATOR 



55 



;; ; Lemma 6. (WF U dU rU) , 



(def-dtuple (D-chain ((C 


(Pred U)> 




(A > 


O 






(dA 


(Pred A)) 




(rA 


(Rel 


A)) 




(a , 


ft))) 




<(B *) 








(dB (Pred B)) 








(rB (Rel B)) 








(f (B -> A)) 








(ci (C (inj B dB rB))) 






(m (Embed B dB rB 


A dA 


rA i 


a)))) 


(del lemma6 








(\ ((C (Pred U)> 








(c (Chain U dU 


rU O) 




(T *) 








(fT (T -> T))) 








(QChain 








c 

U dU rU C 








T 









(mlet ((uZ c.z) 

(duZ c.dz) 
(cuZ c.cz)) 
(let ((cp (Predec U dU rU C c.z c.cz) 
(c.pr c.z c.cz)) ) 
(GPredec 
cp 



chain constructed in an ordered set OA 



; element of D chain to consider 
; preceding ordered set OB 



; embedding function from B to A 
; proof that OB is in C chain 
; proof that f embeds OB into OA, 
; bounded by a 



; chain in U 

; proof that C is a chain 

; ** looping type ** 

; ** looping function ** 

; open c 



; result type 

; uZ is base of chain C 

; uZ in dU 

; uZ in chain 

; predecessor of uZ exists and is in C 

; open predecessor proof 



U dU rU C c.z c.cz T 
(SrU 

cp . ryx 

cp.y c.z T 

(mlet ((Z cp.ryx.B) (dZ cp.ryx.dB) (rZ cp.ryx.rB) ; the actual OZ 

(W cp.ryx.A) (dW cp.ryx.dA) (rtf cp.ryx.rA)) ; OW is used in basis 

;; prove that OZ is WF, then apply this to a chain constructed within OZ 
(fT ; ** one loop iteration ** 

(lemma2b ; this will prove (WF OZ) 

Z dZ rZ 

(cp.ryx.j dU duZ) ; proof that (inj OZ) is in dU 

(D-chain C Z dZ rZ) ; chain in OZ 



***y«*««»**t«^ 



sfwps 



iMWPPBff^iWPW, 
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; ; proof that (D-chain C Z dZ rZ) i« a chain 
(ofiabod-ord 
cp.ryac.o 
If dtf *f Z dZ rZ 
(Chain Z dZ rZ (D-chain C Z dZ rZ>) 

xWUHMQ 

cp.ryx,o*tt 

B dlf irll Z dZ rZ cp*ryx.o.f cp.rys«o.b 

(Chain Z dZ rZ (D-chain C 2 dZ *I» 

<- 



Z4Zt% (D-chain C Z dZ rZ) 



; ; baoo of chain in OZ is 
cp.ryx.o*b 



froo proof of Otf < OZ 



; ; proof that baa* it in D-chain 

(-D-chain C Z dZ tZ cp.ryx.o.b 
UdV *f r 

cp.ryx.o.f i 

(cp.ryx.i C cp.cy) ; I 4* 1* C 
cp.ryx.o.n) ; f aatedo « iMo Z 



; ; proof that baoo aatiaf i«o dZ 

cp«4'j!A»©»a\#cH> 



fro» proof of OH < OZ) 
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; ; proof that predecessors exist 
(\ ((a Z) ; for every a in OZ 

(da (D-chain C Z dZ rZ a))) ; that is in chain D. . . 
(mlet ((RT (Predec Z dZ rZ (D-chain C Z dZ rZ) a da))) 
(©D-chain ; open da 

da 

C Z dZ rZ a RT 
(mlet ((Y da.B) (dY da.dB) (rY da.rB)) 

;; OY < OZ and (C (inj OY) ) by da; since OY is in the 
;; chain C, we can find its predecessor by applying c.pr 
(let ((dp (Predec U dU rU C (inj Y dY rY) da.ci) 
(c.pr (inj Y dY rY) da.ci))) 
(OPredec ; open dp 

dp 

U dU rU C (inj Y dY rY) da.ci RT 
(QrU ; open dp.ryx 

dp . ryx 

dp.y (inj Y dY rY) RT 
(mlet ((X dp. ryx. A) (dX dp.ryx.dA) (rX dp.ryx.rA) 

<Y~ dp. ryx. B) (dY~ dp.ryx.dB) (rY~ dp.ryx.rB)) 
;; OX < OY" and (C (inj OX)), 
; ; so apply lemma3 to get OX < OZ 
(let ((1 (L3-conseq X dX rX Z dZ rZ a) 

(lemma3 X dX rX Y dY rY Z dZ rZ 

; ; proof that OX < OY from OX < OY" 
(lemmal Y~ dY" rY" Y dY rY 

(eq-sym U (inj Y dY rY) 
(inj Y" dY" rY~) 
dp.ryx. j) 
(\ ((A *) 

(dA (Pred A)) 
(rA (Rel A))) 
(Embed-ord X dX rX A dA rA)) 
dp. ryx. o) 
; ; embedding from OY to DZ 
da.f a da.m) )) 
(GL3-conseq ; open lemma3 result 
1 

X dX rX Z dZ rZ a RT 

;; proof that l.b is predecessor of a in D chain 
("Predec 

Z dZ rZ (D-chain C Z dZ rZ) a da 
l.b 

; ; proof that l.b is in D 
("D-chain C Z dZ rZ l.b 

X dX rX ; preceding set is OX 
l.f ; embedding function is f 

(dp.ryx. i C dp.cy) ; OX is in C 
l.m) ; f , l.b embed OX into OZ 
;; proof that l.b precedes a in OZ 
l.rb) 
))))))))))))) 
T fT) ; ** looping arguments to lemma2b ** 

))))))))) 
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;;; Initial segments of ordered sets. 

(def-dtuple (Seg ((A *) 

(dA (Pred A)) 
(rA (Rel A)) 
(a A) 
(x A))) 
((d (dA x)) 
(r (rA x a)))) 



; segment of OA 



; determined by a 

; x is in OA 
; x less than a 



Lemma 7. If (dU QA) and (dA a) for some a : A, then (dU (inj OAa) ) . 



(def lemma7 
(\ ((A *> 

(dA (Pred A)) 
(rA (Rel A)) 
(a A) 

(di (dU (inj A dA rA))) 
(da (dA a))) 
(mlet ((iA (inj A dA rA)) 

(sA (Seg A dA rA a))) 
(QdU di iA 

(dU (inj A sA rA)) 

(let ((t (Trans A dA rA) 

(lemma2a A dA rA di)) 
(w (WF A dA rA) 

(lemma2b A dA rA di))) 
; ; prove that (inj OAa) satisfies dU 
(~dU (inj A sA rA) 
A sA rA 

; ; proof that (inj OAa) = (inj OAa) 
(eq-ref U (inj A sA rA)) 
; ; OAa is transitive 



; injection of OA into U 

; segment of OA we're interested in 

; open di 

; result type 

; given proof that OA is transitive 

; given proof that OA is well-founded 



; OAa is WF since a chain in the segment is a chain in the set 
(\ ((C (Pred A)) 

(c (Chain AsArAC))) 
(GChain c A sA rA C ; open c 

Loop ; result type 

(€Seg c.dz A dA rA a c.z ; open c.dz 
Loop ; result type 
(w C 

("Chain A dA rA C 
c.z 
c.cz 
c . dz . d 
c.pr))))))))))) 
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;;; Lemma 8. If (dU (inj 0A)), then OA < QU. 

(def lemma8 
(\ ((A *) 

(dA (Pred A)) 
(rA (Rel A)) 

(di (dU (inj A dA rA)))) 
(mlet ((f (\x A (inj A (Seg A dA rA x) rA))) ; mapping A -> U 
(b (inj A dA rA))) ; bound on mapping 

; ; prove that f embeds OA into U, bounded by b 
("Embed-ord A dA rA U dU rU f b 
("Embed A dA rA U dU rU f b 

; ; embedding bound satisfies domain 
di 



» » 


f preserves domain 


(\ 


((x A) 




(dx (dA x))) 




(lemma7 A dA rA x di dx)) 


t * 


f is monotonic 


(\ 


((x A) 




(y A) 




(dx (dA x)) 




(dy (dA y)) 




(rxy (rA x y))) 




(mlet ((sx (Seg A dA rA x)) ; segment determined by x 




(sy (Seg A dA rA y))) ; segment determined by y 




("rU (f x) (f y) 




A sx rA 




A sy rA 




(eq-ref U (inj A sx rA)) 




(eq-ref U (inj A sy rA)) 




(mlet ((fA (\x A x))) ; mapping A -> A 




; ; prove that f A embeds (f x) into (f y) , bounded by x 




("Embed-ord A sx rA 




A sy rA 




f A x 




("Embed A sx rA 




A sy rA 




f A x 




; ; bound x is in domain of (f y) 




("Seg A dA rA y x dx rxy) 




; ; f A preserves domain 




(\ ((a A) 




(da (sx a))) 




(ClSeg da 




A dA rA x a 




(Seg A dA rA y a) 




("Seg A dA rA y a 




da.d 




(Gemma2a A dA rA di) 




a x y 




da.r rxy)))) 
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; ; i A is monotonic 
(\ ((a A) 
(b A) 

(da (sx a)) 
(db (sx b)) 
(rab (rA a b))) 
rab) 
; ; x dominates ran f A 
(\ ((a A) 

(da (sx a))) 
(«Seg da 

A dA rA x a 
(rA a x) 
da.r)))))))) 

; ; b dominates ran f 
(\ (<x A) 

(dx (dA x))) 
(mlet ((sx (Seg A dA rA x) ) ) ; segment determined by x 
(*rU (f x) b 
A sx rA 
A dA rA 

(eq-ref U (inj A sx rA)) 
(eq-ref U (inj A dA rA)) 
(mlet ((fA (\x A x))) ; mapping A -> A 

; ; prove that f A embeds (f x) into OA, bounded by x 
("Embed-ord A sx rA 
A dA rA 
f A x 

(~Embed A sx rA 
A dA rA 
f A x 

; ; bound is in domain 
dx 

; ; f A preserves domain 
(\ ((a A) 

(da (sx a))) 
(fiSeg da 

A dA rA x a 
(dA a) 
da.d)) 
; ; f A preserves order 
(\ ((a A) 
(b A) 

(da (sx a)) 
(db (sx b)) 
(rab (rA a b))) 
rab) 
; ; x dominates ran f A 
(\ ((a A) 

(da (sx a))) 
(fiSeg da 

A dA rA x a 
(rA a x) 
da.r)))))))) ))))) 
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;;; Contradiction. 

(do* u (iaj U dtf rU» ; injection of §9 into itool* 

(dof da ; m tt> 

<"dU u U dU rU 
(oq-rof u) 

»6)> 



(do* ru ; (rU t q) 

<*rU u a 

U dU rU 
U dU rU 
(oq-iro* U u) 
(oq-rof to) 
QoHMSUda rtT da)» 



(dof C (Vr UOqUf n>» ; chain in U 



(dof cG OC&oia U dU rU C 




• 


proof tfctt e i* * caoin 


n 




J 


booo of rlii f n 


(04-Tof U *) 




1 


nooo io inC, 


dn 




J 


mm in* 


(\ ((* U) 




*■ 


yrtotcooowr of «*f v 


Cct « »») 




r 


tfcfct lo ia t 


(**ro4o« U dU rtl C t cy 








* 




i 


i» n* 


(oq-rof m> 




j 


«feic* i* i* C aloe, 


((•q-ifl U t u 


or> 


; 


.-ajMl io o»aTl<i Hi in n 


(\* » (rU n w)) m> 




)») 









(dots loop (lonu6 C cO) ; f # l # ». 
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